Privacy Notice of Cempa

Version 1.0 — last updated: October 9, 2026

This English translation is provided for convenience only. The Spanish version is the legally binding one and prevails in case of any discrepancy.

At Cempa we help families preserve the memory of their loved ones on a digital memorial page. To do so we process personal data, and we want you to know clearly which data, for what purposes, with whom we share them and how you can decide about them. This Privacy Notice is issued in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the Official Gazette of the Federation (Diario Oficial de la Federación) on March 20, 2025) and other applicable provisions.

This document has two parts. Part A is the Comprehensive Privacy Notice, published at https://cempa.app/privacy. Part B contains the simplified privacy notices displayed on each form or message where we collect data.

Part A. Comprehensive Privacy Notice

1. Data controller

[RAZÓN SOCIAL] (“Cempa”, “we”), with its address at [DOMICILIO] and RFC [RFC], is the controller responsible for the processing of your personal data on the website https://cempa.app and in related services (the “Service”). CEMPA™ is a trademark with an application pending before the IMPI.

For any personal data matter, write to [CORREO DE PRIVACIDAD]. For general support: support@cempa.app and [TELÉFONO].

2. To whom this Notice applies

In this Notice we use the following terms, with the same meaning as in the Terms and Conditions (https://cempa.app/terms):

• User: the person who has an account with Cempa as a family member or person responsible for a memorial page. They may have registered on their own or have received an invitation because a Funeral Home requested the page. The User who manages a page is its “Holder” (Page Holder) in the Terms and Conditions.
• Funeral Home: the funeral agency that offers Cempa to its customers. It also includes the people who work there and use the Service with a staff account, such as administrators or editors.
• Visitor: any person who views a public memorial page, whether or not they have an account.
• Memorial page or Page: the page dedicated to the memory of a deceased person that is created in the Service.

In this Notice, “data subject” (in Spanish, “titular” written in lowercase) refers to the person to whom the personal data belong, as the term is used in the law.

3. Personal data we process

3.1 Users

• Identification and contact. Name, email address and username. If the Page was requested by a Funeral Home, also the telephone number it provides to us.
• Account access.
  • Password. We store it protected by a function that does not allow it to be recovered.
  • Temporary codes to confirm your email address.
• Sign-in with Google, if you choose to use it.
  • What Google shares with us with your authorization: your Google account identifier, your name, your email address, confirmation that the email address is verified and the address of your profile photo.
  • The first time you sign in with Google, we create a username and a password for your account and send them to you by email.
• Account data. Account type, role, registration date, date of last access and a log of relevant operations in the Service.
• Record of acceptance of the Terms and Conditions.
  • Version accepted and date and time.
  • IP address and browser data.
  • Means by which it was accepted: email, Google or Funeral Home invitation.
• Content you upload or edit on the Page.
  • Photographs and their descriptions, biographical texts, quotes and the names of their authors.
  • Links to other websites.
  • Location of the burial site: address, coordinates and directions.
  • Photo files may contain metadata, such as the date, device or place where they were taken. This metadata is stored and may be downloaded together with the photo. We recommend removing it before uploading.
  • This content may include data about you or about other living persons (see section 3.5).
• Communications with Cempa. The content of the requests, questions or complaints you send us.

3.2 Funeral Home staff and Funeral Home data

• Funeral Home staff.
  • Name, email address and username.
  • Password, stored in the same protected manner.
  • Funeral Home to which they belong and role.
  • Dates of registration and last access.
  • Log of the operations they perform, such as the Page requests they create or edit.
• Funeral Home profile. Name, email address, telephone number, description and logo. These are displayed on the Funeral Home’s public profile on Cempa.
• Commercial relationship with the Funeral Home.
  • Corporate or individual name, RFC, tax regime and address.
  • Billing email address and name and telephone number of the contact person.
  • Tax status certificate (Constancia de situación fiscal) and tax receipts (CFDI).

When the Funeral Home is an individual, these data are personal data and are processed in accordance with this Notice.

3.3 Visitors

To view a public Page or light a virtual candle you do not need to register, and Cempa does not ask you for personal data. Candles are counted anonymously.

When you browse, your browser automatically communicates certain technical data to our servers and to the external services described in section 9: the IP address, the browser type and the date and time of the visit.

3.4 Persons who submit notices, complaints or requests to us

Any person, whether or not they have an account, may write to us to:

• notify us about content on a Page;
• file a complaint;
• object to the publication of a Page;
• request the transfer of the management of a Page;
• respond, as the manager of a Page, to a notice about its content (counter-notice); the response is shared with the person who submitted the notice;
• exercise their rights over their personal data (section 11).

Depending on the case, we process the following data of the person who writes to us and, where applicable, of the person they represent:

• name, email address or other contact detail, and postal address;
• official identification and document evidencing the representation;
• documents evidencing the death or the situation of the person who manages the Page and the family relationship with the deceased person;
• documents regarding copyright;
• the content of the communication.

Some of these documents contain data about other living persons. We use them only to handle the request and to evidence that we handled it (section 13).

3.5 Persons who appear in the content

A Page may contain photographs, names or memories of living persons, such as family members who appear in a photo or the author of a quote. This information is uploaded by the User or the Funeral Home, not by the person who appears in it. Under the Terms and Conditions, whoever uploads the content must have the consent of the living persons who appear in it.

If you appear on a Page and want your information corrected or removed, you have two options:

• Fastest: submit a content notice in accordance with the Terms and Conditions.
• Rights over your data: exercise your rights in accordance with section 11.

3.6 Sensitive personal data

Cempa does not request sensitive personal data, and no field in the Service is designed to collect it. Sensitive data are, for example, data that reveal:

• racial or ethnic origin;
• health status or genetic information;
• religious, philosophical or moral beliefs;
• trade union membership or political opinions;
• sexual preference.

The texts on a Page are free-form. We ask you not to include sensitive data of living persons, including your own. If a Page contains sensitive data of a living person without their consent, that person may ask us to remove it in accordance with section 11, and we will remove it.

3.7 Data we do not collect

Through the Service we do not collect financial data from Users or Visitors, such as card or bank account numbers. In the sales channel through Funeral Homes, the family pays for the service directly to the Funeral Home.

4. How we obtain your data

• Directly from you: when you register, sign in, edit your Page or write to us.
• From Google: if you choose to sign in with your Google account.
• From the Funeral Home: when it requests a customer’s Page in the Service or creates an account for a member of its staff.
  • When requesting a Page, the Funeral Home provides us with the customer’s name, email address and telephone number, and the name and dates of birth and death of their loved one.
  • Cempa makes this Notice available in the first email it sends to each person, together with their access details.
• Automatically: through the technologies described in section 9.

5. Purposes of processing

5.1 Purposes necessary for the Service

We use your personal data to:

1. Create, manage and protect your account, confirm your email address and allow you to sign in, including with Google.
2. Create, edit, save, publish and display Pages, and generate their link and QR code. Also so that public Pages can be found through the Service’s search.
3. Handle a Funeral Home’s request:
   • create the account of its customer or of its staff and send them the invitation and access details;
   • manage the preparation and review of the Page;
   • inform the Funeral Home of the status of the Page;
   • contact the customer by telephone about their Page when it is not possible by email.
4. Send you messages related to the Service: confirmation codes, access details, temporary passwords, notices about your Page and notices of changes to this Notice or to the Terms and Conditions.
5. Record and keep the record of your acceptance of the Terms and Conditions.
6. Manage the commercial relationship with Funeral Homes: onboarding, licenses, billing, issuance of CFDI and collections.
7. Handle your requests, questions and complaints, ARCO rights requests, content notices and requests to transfer the management of a Page.
8. Maintain the security of the Service: verify identities, prevent unauthorized access, fraud and abuse, and keep operation logs.
9. Prepare internal statistics with aggregated information, for example, the number of Pages created by each Funeral Home or of candles lit on a Page.
10. Comply with Cempa’s legal obligations and respond to requests from competent authorities.

These purposes are necessary to provide you with the Service. If you object to them or revoke your consent, we may not be able to continue providing it to you.

5.2 Secondary purposes (require your authorization)

As of the date of this Notice, Cempa does not send promotional emails or invitations to surveys or interviews.

If we do so in the future, we will use your name and email address only with your authorization, to:

1. Send you news, promotions and reminders from Cempa, for example, on the occasion of the Day of the Dead (Día de Muertos) or commemorative dates.
2. Invite you to answer surveys or take part in interviews to learn your opinion about the Service.

Before sending you any of those messages, we will ask for your authorization:

• with a checkbox for each purpose;
• the checkbox will appear unticked;
• if you do not tick it, we will not use your data for that purpose;
• your decision does not affect the Service you receive.

We do not use your telephone number to send you advertising.

5.3 How to refuse or change your mind

You may tell us now that you do not want us to use your data for secondary purposes by writing to [CORREO DE PRIVACIDAD].

When such messages are enabled, you will also be able to withdraw your authorization at any time in two ways:

• through the “Unsubscribe” link that each email of that kind will include, which will work without signing in;
• in your account settings.

You will continue to receive the messages necessary for the Service.

6. Information about deceased persons

The Federal Law on the Protection of Personal Data Held by Private Parties does not expressly regulate information about deceased persons. Even so, Cempa treats the information about your loved one with confidentiality and respect, and uses it only to create, keep and display their Page.

The Terms and Conditions explain:

• who manages the Page;
• who may request changes;
• what happens to its content if the Service is cancelled.

7. With whom we share your data

7.1 Providers that process data on Cempa’s behalf (processors)

To operate the Service we rely on providers that process personal data solely on Cempa’s behalf (encargados). They follow our instructions and may not use the data for their own purposes.

• Technology infrastructure: servers, databases and storage of files and photographs.
• Email: sending the emails we send you and receiving those you send us.
• Electronic invoicing: issuance of CFDI to Funeral Homes through an authorized certification provider.

Some of these providers may be located outside Mexico. We require each of them to process the data confidentially and to apply appropriate security measures.

7.2 Transfers to third parties

Cempa does not sell or rent your personal data. We disclose them to third parties only in the cases in this section and in section 7.3. Those in the following table do not require your consent under article 36 of the Law.

What the Funeral Home can do with the Page:

• The administrators of the Funeral Home’s account can view the Page in any status, even if it is private and after you accept it. This access continues for as long as the Funeral Home’s account is active in the Service.
• The Funeral Home staff who prepare the Page can edit it while preparing it, but no one at the Funeral Home can edit it after you accept it.
• When the Page is cancelled, it is no longer displayed to the Funeral Home either (section 13).

If in the future we wished to make another transfer that requires your consent, we will ask for it before making it, expressly and separately.

7.3 If Cempa stops providing the Service or transfers its operation

If Cempa stops providing the Service:

• We will notify you by email and on the website at least 90 calendar days in advance.
• Before that period ends we will send to your account email a digital copy of the texts and photographs of your Pages or a link to download it. You may also request it at any time during that period.
• At the end of the period, we will permanently delete your data, except for the data we must keep by law (section 13).

If the operation of the Service is transferred to another company (for example, by merger, spin-off (escisión) or assignment):

• Your personal data will pass to that company only so that it can continue providing you with the same Service, under the terms of this Notice.
• Since this transfer requires your consent, we will inform you by email at least 90 calendar days in advance and indicate which company will continue the Service.
• Before the transfer date, you may object to it by writing to [CORREO DE PRIVACIDAD]. If you object:
  • you may cancel the Service without penalty;
  • we will send you a digital copy of the texts and photographs of your Pages;
  • your data will not be transferred: your Pages will no longer be displayed and your data will be permanently deleted, except for the data we must keep by law (section 13).
• If you do not object before that date, we will understand that you tacitly consent to the transfer of your data.
• The new company must respect this Notice and make its own privacy notice available to you.

7.4 Artificial intelligence features

As of the date of this Notice, the Service does not send your content to artificial intelligence providers.

In the future we may offer optional features of that kind, for example, to enhance photographs, animate portraits, transcribe audio or review the wording of a text. Before activating them:

• we will update this Notice and notify you as indicated in section 16;
• the providers will participate only as processors and may not use your content for their own purposes, such as training their models;
• if any provider needed to use it for its own purposes, we will treat this as a transfer and ask for your express consent before sending it any data;
• we will inform you if those providers are located outside Mexico.

7.5 Third-party services you use from the website

Some external services receive certain data directly from your browser and process them in accordance with their own privacy notices. They may be located outside Mexico. They are the following:

• Google, for signing in;
• OpenStreetMap maps;
• the service that delivers the map icons (section 9);
• WhatsApp, if you write to us through that channel from the link on the website. It is a channel for general inquiries; to exercise your rights over your personal data, use the email or the form in section 11.

8. Public memorial pages

When a Page is published:

• Its content can be seen by anyone who has the link or scans its QR code, including photographs with their metadata (section 3.1).
• The Page can be found through the Cempa search by the name of the deceased person.
• Over time, it may also appear in internet search engines.

Before publishing, check that the content does not include information about living persons who do not wish to appear on it. You can unpublish the Page from your account at any time.

9. Tracking and in-browser storage technologies

As of the date of this Notice, Cempa does not use advertising cookies or third-party analytics or tracking tools. We use only the technologies necessary for the Service to work:

If in the future we add analytics tools, pixels or other tracking technologies, we will do two things before they start working:

• update this Notice;
• display a notice on your first visit, with the way to disable them.

10. How to limit the use or disclosure of your data

• Ask us not to use your data for secondary purposes, as indicated in section 5.3.
• Switch the Page to non-public from your account.
• Disable the technologies described in section 9.
• Write to us at [CORREO DE PRIVACIDAD] to ask us to limit a specific use or disclosure. If appropriate, we will record your request in an internal exclusion list and confirm it to you by email.

11. ARCO rights: access, rectification, cancellation and objection

You have the right to:

• access your personal data and know how we process them;
• rectify them if they are inaccurate or incomplete;
• cancel them when you consider that they are not required for the purposes of this Notice;
• object to their processing on legitimate grounds.

These rights also belong to living persons who appear in the content of a Page.

How to submit your request. Write to [CORREO DE PRIVACIDAD]. When enabled, you will also be able to use the “ARCO Rights” form in your account. Your request must include:

1. your name and an email address or other means for us to respond to you;
2. the document evidencing your identity or, where applicable, that of your legal representative and the document evidencing the representation;
3. a clear description of the data to which your request refers (not necessary if you are only requesting access);
4. the right you wish to exercise and, if you are requesting rectification, the correction you are requesting, with the supporting document;
5. any other information that helps us locate your information, for example, the link to the Page.

Identity verification. If you have an account with Cempa, we may verify your identity in one of two ways:

• by asking you to sign in;
• by asking you to confirm the request through a link we will send to the email address registered in your account.

In all other cases we will ask you for a valid official identification.

Time limits.

• We will respond to you within a maximum of twenty business days from the date we receive your request.
• If the request is granted, we will give effect to it within the fifteen business days following our response.
• Each time limit may be extended only once for an equal period when the circumstances justify it; if that happens, we will inform you.

Cost. Exercising your rights is free of charge. We could only ask you to cover justified shipping costs or the costs of reproduction in copies or other formats. If you provide us with the means to deliver the information to you, there will be no charge for reproduction.

Means of response. We will respond to you by email. If you request access, we will deliver the information to you in a readable electronic format.

Limits. In some cases the law requires or allows us to keep certain data even if you request its cancellation (section 13). If your request is not granted in whole or in part, we will explain the reason.

Requests are handled by the person Cempa designates for personal data matters, at [CORREO DE PRIVACIDAD].

12. Revocation of consent

You may revoke at any time the consent you have given us, through the same means described in section 11. Revocation does not have retroactive effect.

If you revoke consent for processing necessary for the Service, we may not be able to continue providing it to you; in that case we will inform you beforehand. For secondary purposes, follow section 5.3.

13. Retention and deletion of data

General rule. We keep your data for as long as you have an account with Cempa or for as long as they are necessary for the purposes of this Notice.

Cancellation of a Page and closure of the account. How to cancel a Page and how to close an account is explained in the Terms and Conditions. The cancellation or closure takes effect from the moment we receive your request, and the following happens to your data:

1. If you want the Page to stop being visible instantly, you can make it private yourself from your account.
2. No later than 24 hours after receiving the request, we stop displaying the Page to the public and to the Funeral Home and close access to the account, as applicable.
3. During the following 30 calendar days, the data are kept without being displayed. We only use them to restore the Page or the account, if you request it, or to provide you with a copy.
4. Once that period ends, Cempa undertakes to permanently delete them within the following 30 calendar days.

Request for cancellation of data (ARCO rights). This is a different path, with no restoration period. When a cancellation request under section 11 is granted, we give effect to it within the time limit indicated in that section. The data that the law requires us to keep (see the following paragraph) are blocked: they are kept only to comply with that obligation and to determine possible liabilities, and are not used for anything else. The rest is permanently deleted.

Data we keep for longer. In all the cases above we keep only the following, for the period and for the purpose established by law:

• the record of acceptance of the Terms and Conditions, for at least ten years;
• the information supporting the invoicing to Funeral Homes;
• the log of content notices and complaints.

Request documents. The identification documents and other documents accompanying notices, complaints or requests are kept only for as long as necessary to handle them and to evidence that we handled them.

14. Security

We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing.

No system is completely infallible. If a security breach occurs that significantly affects your property or moral rights, we will inform you immediately by email. We will tell you what happened, which data were affected and what measures you can take to protect yourself.

15. Minors

Cempa accounts are only for persons aged 18 or older (of legal age). We do not intentionally collect data from minors as Users.

If a Page includes photographs or information of a living minor, whoever publishes it must have the authorization of the person who exercises parental authority (patria potestad) or guardianship.

16. Changes to this Notice

We may modify this Notice due to changes in the law, in the Service or in our practices. Each version bears a number and date of last update, and the current version is always published at https://cempa.app/privacy.

Significant changes. These are changes that involve new purposes, new sensitive data or new transfers that require your consent. In those cases:

• we will notify you by email at the address registered in your account at least 15 calendar days in advance, explaining what changes;
• where required by law, we will ask for your consent again before applying the change.

Other changes. They are published on this page with their new date.

We keep previous versions; you can request them at [CORREO DE PRIVACIDAD].

17. Authority

If you consider that your right to the protection of personal data has been violated, you may initiate the rights protection procedure before the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno). It is the competent authority on the protection of personal data held by private parties.

18. Contact

• Personal data, ARCO rights and revocation of consent: [CORREO DE PRIVACIDAD]
• General support: support@cempa.app · [TELÉFONO] (calls and WhatsApp)
• Address: [DOMICILIO]

Version 1.0 — last updated: October 9, 2026