Privacy Notice
Welcome!
We respect your privacy.
We are committed to protecting the interests of the owner as well as providing full transparency and clarity regarding the use we make of their data. We work to develop self-regulatory measures that serve as a reference of good practices in the interactive marketing and digital advertising industry.
We proactively rely on the highest standards set forth by international leaders such as the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA"). In other words, we want to create a culture of handling personal and non-personal data that reflects how we would like other companies to handle our data.
When we refer to "Grupo Hexagon Data", "we", "us" or the "Company" we mean Hexagon Data, S.A.P.I. de C.V., a company incorporated in Mexico, Hexagon Data Colombia, S.A.S., a company incorporated in Colombia, Agradecemos Tu Pago, S.A.P.I. de C.V., a company incorporated in Mexico, and its affiliates, understood as any entity that directly or indirectly controls, is controlled or is under common control, and its affiliates that process personal data in accordance with the terms of this Notice. Our general address for hearing and receiving notifications is located at Filadelfia 128, Int. 101, Colonia Nápoles, Alcaldía Benito Juárez, 03810, Mexico City, Mexico. If you are accessing from Colombia, please review the section below.
In the course of our activities, we process personal data as (a) Controller and (b) Processor.
a. Hexagon Data Group may process personal data of customers, users of our website, suppliers, and people who are in the process of linking or contractual relationship with Hexagon Data Group. In these cases we act as Responsible. Personal data collected will be processed in accordance with the provisions of this Privacy Notice (the "Privacy Notice" or "Notice").
b. In the provision of our products and services, we may process data on behalf of the Customer who is responsible for obtaining consent and complying with applicable laws. In this case Hexagon Data Group is In charge and we abide by the provisions of the Client as well as the provisions of our Data Processing Addendums.
In this Notice we describe the privacy and data protection policies applicable to the treatment that we perform as Responsible for your personal data. We are committed to only collect, use and treat your personal data as provided herein and exclusively for the purposes indicated. Please read carefully this Privacy Notice that we make available to you in compliance with the Federal Law for the Protection of Personal Data in Possession of Private Parties and its Regulations, as well as other applicable laws (the "Law").
DATA WE COLLECT AND THE PURPOSES FOR WHICH THEY ARE PROCESSED
| When you use our Web Site (e.g. visitors or Internet users) |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| Cookies to track your activity on our website. For more information please read the Cookies Policy. | The Website uses different types of cookies to automatically collect and store information about your usage in order to improve its performance and user experience. | Correspond to purposes that give rise to and are necessary for our legal relationship (necessary purposes). | -Consent -Legitimate interest (for strictly necessary cookies) |
| When you contact us (e.g. through the forms on the web site or by e-mail) |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Company name -Phone -Country of residence -Any other information you choose to share with us | -Answering your questions -To offer a customized product or service to each customer. -Customize your experience -Providing technical support -Communicate with you | Correspond to purposes that give rise to and are necessary for our legal relationship. | The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures. -Consent |
| When you create a user account (your "Profile") |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Company name -Phone -Sector to which it belongs (e.g.: publisher, advertiser, agency) | -Create your profile in one of our platforms. -Provide access to your company's dashboard | Correspond to purposes that give rise to and are necessary for our legal relationship. | -The processing is necessary for the performance of the contract between your company and Hexagon Data Group. -Consent |
| When you share your data for marketing, advertising or prospecting purposes (e.g.: subscribe to our newsletter, contact us on our social networks). |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Phone | -Establishing a business connection (networking) -Sending newsletters or other marketing communication -Respond to requests and maintain continuous communication. -For direct marketing | They correspond to secondary or accessory purposes in our legal relationship. | -Consent |
| When we process your application for employment |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Phone -CV -Any other information you choose to share with us | -Evaluate your job application -To be considered as a candidate for the position -Manage the employment relationship | Correspond to purposes that give rise to and are necessary for our legal relationship. | The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures. -Consent -Legitimate interest (to consider the candidate) |
| When we process personal data of our suppliers and partners |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Company name -Phone -Address -Financial information (if applicable) -Any other information you choose to share with us | -Contact us -Perform the provisions of the applicable contract. -Issuing invoice(s) | Correspond to purposes that give rise to and are necessary for our legal relationship. | The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures. -Legitimate interest (arising from the contractual relationship) |
| When we process personal data of our customers |
| Data category | Purpose of treatment: | Purpose Category: | Legal basis |
|---|---|---|---|
| -Full name -Company name -Phone -Address -Financial information (if applicable) -Any other information you choose to share with us | -Contact us -To provide our products and services -Perform the provisions of the applicable contract. -Offer new products or services Issue invoice(s) | Correspond to purposes that give rise to and are necessary for our legal relationship. | The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures. -Legitimate interest (arising from the contractual relationship) |
If you reside or are using the Services in Mexico or any territory governed by privacy laws under which "consent" is the sole or most appropriate legal basis for the processing of personal data, your acceptance of this Privacy Policy will be deemed to be your consent to the processing for the necessary purposes detailed in this Policy. You may revoke your consent at any time as provided in the section entitled "MEANS OF EXERCISING YOUR RIGHTS". We do not sell your personal information for the purposes of the CCPA.
With your explicit consent, we may send notifications and promotional messages regarding new products and services, offers, events or information that we think you may find valuable. If you do not wish to receive such promotional information, you may click on the "Unsubscribe" link found in all marketing emails and your request will be automatically received.
SENSITIVE PERSONAL DATA
Sensitive personal data are those that affect the most intimate sphere of the Data Subject, or whose improper use may give rise to discrimination or entail a great risk for the Data Subject. In particular, sensitive data are considered those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union membership, political opinions or sexual preference.
Hexagon Data Group does not collect or process sensitive personal data.
TRANSFERS OF PERSONAL DATA
We only transfer your personal data in the following cases:
- We contract with companies that provide support services necessary for our services (e.g., system administration and hosting, work management and expert advice, among others). We may transfer your personal information to these providers. Hexagon Data Group enters into a written contract with each supplier that contains its obligations with respect to the protection of personal data no less protective than those described here. We are committed to hiring recognized and leading companies in the market that implement measures with high levels of security for the protection of your personal data.
- In accordance with the Law, the transfer is free without the owner's consent when:
- is provided for by law or any applicable international treaty;
- is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or any company of the same group of the responsible party that operates under the same internal processes and policies;
- is required by virtue of a contract entered into or to be entered into in the interest of the Data Subject, by the Controller and a Third Party;
- is necessary or legally required for the safeguard of a public interest, or to procure or administer justice;
- is necessary for the recognition, exercise or defense of a right in a judicial proceeding; and
- is necessary for the maintenance or fulfillment of a legal relationship between the Controller and the Data Subject.
INTERNATIONAL TRANSFERS AND DATA LOCALIZATION
Your personal data will be collected, transferred and stored by Grupo Hexagon Data and our suppliers in Colombia, Spain, United States of America, Mexico and other locations as necessary for the proper performance and delivery of our services or as required by applicable law. Although privacy laws may vary between jurisdictions, Grupo Hexagon Data is committed to protecting personal data in accordance with this Privacy Policy, customary industry standards and contractual terms that require adequate data protection, regardless of any less protective legal requirements that may apply in the jurisdiction to which such data is transferred.
DATA RETENTION
We retain personal data for as long as necessary to comply with our legal and contractual obligations, including the blocking period established by law. Once the retention period has expired, we will delete your personal data and, to the extent possible, we undertake to return the data upon request.
MEANS TO EXERCISE YOUR RIGHTS
At any time you may limit or revoke the use, disclosure or consent to the processing of your personal data. When the limitation prevents the provision of a service you have contracted with us, the treatment will continue as you have authorized until the termination of the service. Also, at any time you may access, rectify, cancel or oppose the use of your personal data (exercise your ARCO Rights). To exercise your rights, please send a request to the following e-mail address privacy@hexagondata.iowhich corresponds to the area in charge of personal data within Hexagon Data Group. Such request must contain the following:
- name of the Data Subject and address or other means to communicate the response to your request;
- documents proving their identity or legal representation of the Holder;
- a clear and precise description of the personal data with respect to which you wish to exercise your ARCO Rights;
- any other document that facilitates the location of the personal data; and
- in case of rectification, the documentation supporting the request.
We will inform you of the decision taken, by the same means in which we receive the request, within a maximum period of 20 (twenty) business days after we receive the request. If the decision is appropriate, we will make it effective within 15 (fifteen) business days after we communicate the response. When the circumstances justify it, the referred terms may be extended for equal periods.
CHANGES TO THE PRIVACY NOTICE
We seek to continually improve our services, so we reserve the right to change and/or update this Privacy Notice. The new version will become effective on the date indicated at the beginning of this Notice. In case we consider that there are substantial changes we will notify you through the publication of a visible notice on our website or by any of the available means of communication. Entry into force will be deemed accepted by you. We encourage you to constantly review our website during the term of our relationship.
USE OF COOKIES AND OTHER SIMILAR TECHNOLOGIES
Our Website uses cookies, anonymous identifiers, tags and other technologies to provide our services, to ensure they function properly, to analyze our performance, to conduct marketing activities and to personalize your experience. For more information, please see our Cookies Policy
DATA SECURITY
Hexagon Data Group implements appropriate technical and organizational measures to protect the security, confidentiality and integrity of your personal data. We establish and maintain administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. We do not adopt lesser security measures than those we maintain for the management of our information.
Security measures include: (a) anonymization and/or pseudonymization of personal data, to the extent possible; (b) we protect the security of your information during transmission to or from websites, APIs, applications, products or services of Hexagon Data Group through the use of encryption software and protocols; (c) we create specific access keys for each actor involved in data processing; (d) we adopt internal measures for the handling of data by our collaborators; (e) we make sure that our suppliers comply with the highest standards of data security and privacy, in compliance with the applicable Laws; and (f) we make sure that the contracts entered into with the persons in charge include clauses that clearly establish their duty to guarantee the security and privacy of the data subject's information.
ADDITIONAL NOTICES
MINORS
At Hexagon Data Group we do not collect personal data from children under 18 years of age. If you are a minor and for any reason you provide us with this information, we will immediately delete your personal data as soon as we are aware of it. If you believe that we may have personal data from a minor, please contact us via email at privacy@hexagondata.io
DATA PROTECTION OFFICER (DPRG)
Itzayana Tlacuilo has been appointed by the company to supervise how personal data is handled, as well as to inform and advise employees about their obligations related to data protection. To contact please send an email to privacy@hexagondata.io.
ADDITIONAL INFORMATION FOR COLOMBIA
If you reside in Colombia and/or have a business relationship with Grupo Hexagon Data in Colombia, we indicate as your address to hear and receive notifications related to this Notice, the address located at Cl 98 # 22-64 P 12, Bogotá D.C., Colombia; telephone +57 3123403064.
We undertake to act under the legal guidelines and as provided by the applicable regulations, in particular Law 1581 of 2012, Decree 1377 of 2013 and other regulations that modify, supplement or repeal them, relating to the processing of personal data carried out in Colombian territory or when the Controller or Processor not established in national territory is subject to Colombian law by virtue of international standards and treaties.
In addition to the rights mentioned in the section "MEANS TO EXERCISE YOUR RIGHTS", the holder may request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing. Therefore, Hexagon Data Group requests that the owners give their express consent, through any means, before sharing their data with the Company. We are committed to put at your disposal different mechanisms to make this right effective, however if the holder does not give their explicit consent and still makes available to Hexagon Data Group their personal data then releases Hexagon Data Group of that requirement.