Account and Data Deletion

1. Scope of this document

This document explains how to request the deletion of an account and its associated personal data in Espres — Ventas en ruta. The data controller responsible for processing the personal data collected is Alexis Ulises Barba Pérez, operating under the commercial name "Espres", with the following identification details — Legal name: Alexis Ulises Barba Pérez ("Espres"); Tax ID (RFC): BAPA950302880; Registered address: Calle Ures #450, Tepic, Nayarit, C.P. 63058, Mexico; Contact email: hola@espres.app.

Espres offers two types of accounts: (i) the administrator or owner account, created by the person themselves when registering their organization at espres.app; and (ii) the salesperson or field staff account, created by that organization's administrator — the mobile application does not allow new accounts to be registered.

2. How to request deletion

Account deletion is requested as follows, depending on the account type: (i) if you are a salesperson or field staff member, send a request from the email address registered to your account to privacidad@espres.app, with the subject "Account Deletion", indicating the name of your organization — if you cannot send the request from that address, for example because you no longer have access to it, you must include a copy of a valid government-issued ID to prove your identity; (ii) if you are an administrator or owner and wish to delete your entire organization, you may do so immediately from the web application, under Administration › Organization › "Delete organization", with no email request required; (iii) if you are an administrator or owner and wish to delete only your personal account while keeping the organization, send the request to privacidad@espres.app as described in item (i) — before it is carried out, the organization must have at least one other active administrator, who can be designated from Administration › Users, a requirement that prevents the organization from being left without anyone to administer it; and (iv) alternatively, you may also ask your organization's administrator to deactivate your account from the users panel.

There is no mandatory prerequisite step to request deletion of an individual account. Cancelling a subscription, where one exists, is done separately from the administration panel and is governed by the Subscription Agreement; the mobile application does not offer payment options.

3. What is deleted

When an individual account deletion request is fulfilled, the access account and everything that composes it is permanently deleted: (a) the email address associated with the account; (b) the password and its authentication credentials; and (c) the linked session tokens and device identifiers. After deletion it is not possible to log in again, and Espres no longer retains the account holder's credentials.

When the request comes from the administrator and covers the entire organization, all of that organization's data is also deleted: customers, sales, inventories, routes, settlements, configuration, stored files, the audit log, and every access account of its members.

Espres does not store card numbers or security codes; payment data is processed directly by Stripe.

4. What is retained and why

The employment record your organization keeps about you —name, phone number and role— as well as the operational history you generated —sales, visits, collections and settlements— belong to your employer organization, which is the data controller with respect to that data. Espres retains it only on the organization's behalf, acting as a data processor. Deleting your access account does not delete those records; to request their deletion you must contact your organization. This retention is grounded in Article 26 of the LFPDPPP, which allows a controller to deny cancellation when the data are necessary for an existing legal relationship, as well as in the record-retention obligations that labor and tax law impose on employers.

Digital tax receipts (CFDI) and the associated accounting records are retained for the period required by applicable tax legislation.

Geolocation data is automatically deleted 30 calendar days after its capture, regardless of any request, in accordance with the Location Tracking Privacy Notice.

Minimal information may be retained where there is a legal obligation, an ongoing security or fraud investigation, or a duly grounded and motivated request from a competent authority.

5. Deleting an organization: a prior warning

Deleting an organization from the web application is immediate, final, and creates no copy. Espres does not retain a recoverable backup of a deleted organization and cannot reverse the operation. If you wish to keep your information, export it before carrying out the deletion, using the export functions available in the application.

The thirty (30) calendar-day period set out in clause 8 of the Terms of Service corresponds to termination of the service —due to subscription cancellation, non-payment, or termination by Espres— a case in which the data is retained for that period to allow it to be exported. That period does not apply when the administrator voluntarily carries out the deletion of their organization, since in that case deletion is immediate by the account holder's express decision.

6. Response times

Espres will respond to the request within twenty (20) business days following its receipt and, if appropriate, deletion will be carried out within fifteen (15) business days following the response, in accordance with the ARCO rights mechanism published in the Privacy Notice. Deletion of an organization carried out by the administrator from the web application is immediate.

7. Partial deletion without closing the account

If you only wish to delete part of your data or stop being subject to a specific processing activity —for example, location tracking— you may exercise the rights of Cancellation or Opposition without closing your account, by sending your request to the same address, privacidad@espres.app, with the subject "ARCO Rights Request", in accordance with the Privacy Notice. Location tracking can also be disabled at any time by asking the administrator to change the tracking mode from the administrative panel.