Welcome!
We respect your privacy.
At Hexagon Data Group we are committed to protect the interests of the data subject and to provide full transparency and clarity regarding the processing of your data. We work to develop self-regulatory measures that serve as a reference of good practices in the interactive marketing and digital advertising industry. In this regard, we rely on the highest standards set by international leaders such as the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). In other words, we want to create a culture of data processing, personal and non-personal, reflected on how we would like other companies to treat ours.
When we refer to “Hexagon Data Group”, “we”, “us”, or the “Company”, we mean Hexagon Data, S.A.P.I. de C.V., a company incorporated in Mexico, Hexagon Data Colombia, S.A.S., a company incorporated in Colombia, Agradecemos Tu Pago, S.A.P.I. de C.V., a company incorporated in Mexico, and its affiliates, meaning any entity that directly or indirectly controls, is controlled by, or is under common control, that processes personal data in accordance with the terms of this Notice. The general address to hear and receive notices is Filadelfia 128, Int. 101, Colonia Nápoles, Alcaldía Benito Juárez, 03810, Mexico City, Mexico. If you access from Colombia, please review the specific section addressed below.
Through our business activities we process personal data as (a) Controller and (b) Processor.
a. Hexagon Data Group may process personal data of customers, users, providers, and persons who are in the process of entering into a contractual relationship with Hexagon Data Group. In these cases we act as the data Controller (also known as “data responsible”). The collected personal data will be processed in accordance with this Privacy Notice (the “Privacy Notice” or “Notice”).
b. While providing our products and services, we may process data on behalf of our customers who shall be responsible for obtaining consent and complying with applicable laws. In this case, Hexagon Data Group is the Processor and we process according to the instructions of the controller as well as to the provisions established in our Data Processing Addendums.
The intent of this Privacy Notice is to inform the privacy and data protection policies applicable to the processing of your personal data that we undertake as a Controller. We only collect, use and process your personal data as provided and exclusively for the purposes indicated herein. Please read carefully this Privacy Notice which we make available to you in compliance with the Federal Law on the Protection of Personal Data in Possession of Individuals, as well as other applicable laws (the “Law”).
DATA WE COLLECT AND ITS PURPOSE
| When you use our Website (e.g. visitors or Internet users) |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| Cookies to track your activity on our Website. For more information, please read the Cookie Policy | The Website uses different types of cookies to automatically collect and store information about your usage in order to improve its performance and user experience | These purposes give rise to and are necessary for our legal relationship. (Necessary purposes) | •Consent •Legitimate interest (for essential cookies) |
| When you contact us (e.g.: through forms on our website or by e-mail) |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •Company name •E-mail address •Telephone •Country of residence •Any other information you decide to share with us | •Answer your questions •Offer a personalized product or service to each client •Personalize your experience •Provide technical support •To maintain communication | These purposes give rise to and are necessary for our legal relationship. | •Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract •Consent |
| When you create your user account (“Profile”) |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •Company name •E-mail address •Telephone •Sector which you belong to (e.g. publisher, advertiser, agency) | •Create your profile within any of our platforms •Give access to your company’s dashboard | These purposes give rise to and are necessary for our legal relationship. | •Processing is necessary for the fulfilment of the contract between the your company and Hexagon Data Group •Consent |
| When you share personal data for marketing purposes (e.g. by subscribing to our newsletter or by contacting us on social media) |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •E-mail address •Telephone | •To establish a business connection (networking) •To send newsletters or other marketing communications •To respond to requests and keep ongoing communication •For direct marketing | These purposes are secondary or accessory in our legal relationship. | •Consent |
| When we process your job application |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •E-mail address •Telephone •Resume (CV) •Any other information you decide to share with us | •To process and assess your job application •To consider you as a candidate for the position •To manage the employment relationship | These purposes give rise to and are necessary for our legal relationship. | •Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract •Consent •Legitimate interest (to assess the candidate) |
| When we process personal data of our providers and partners |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •Company name •E-mail address •Telephone •Address •Financial information (when applicable) •Any other information you decide to share with us | •Maintain contact •For the fulfillment of the applicable agreement •Issue invoice(s) | These purposes give rise to and are necessary for our legal relationship. | •Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract •Legitimate interest (related to the contractual relationship) |
| When we process personal data of our customers |
| Type of personal data we collect | Processing purposes | Purpose category | Legal basis |
|---|---|---|---|
| •Full name •Company name •E-mail address •Telephone •Address •Financial information (when applicable) •Any other information you decide to share with us | •Maintain contact •To provide our products and services •For the fulfillment of the applicable agreement •To offer new products and services •Issue invoice(s) | These purposes give rise to and are necessary for our legal relationship. | •Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract •Legitimate interest (related to the contractual relationship) |
If you reside or are using the services in Mexico or in any territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for processing personal data, your acceptance of this Privacy Notice will be deemed to be your consent to the processing of your personal data for the necessary purposes detailed in this Notice. You may revoke your consent at any time as provided in the Section entitled “MEANS TO EXERCISE YOUR RIGHTS”. We do not sell your personal information for the intents and purposes of the CCPA.
Provided your explicit consent we may send you notices and advertisements about new products and services, offers, events or information that we think you will find valuable. If you do not wish to receive such promotional information, click on the “Unsubscribe” link included in all the marketing emails and your request will be automatically received.
SENSITIVE PERSONAL DATA
The personal data considered sensitive is the one which affects the most intimate aspects of the data subject or whose improper use may give rise to discrimination against or entail a great risk. Sensitive data is considered one that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, trade union membership, political opinions or sexual preference.
Hexagon Data Group does not collect nor process sensitive personal data.
TRANSFER OF PERSONAL DATA
We only transfer your personal data under the following cases:
- We hire providers for support services necessary to fulfill our services (e.g. system administration and hosting, work management and expert advice among others). We may transfer your personal data to these providers. Hexagon Data Group holds a written contract with each provider that includes contractual clauses no less protective than those described herein. We hire recognized, market-leading companies that implement high level security measures for the protection of your personal data.
- According with the Law, the transfer of data does notrequire consent in the following cases:
- when the transfer is required by the Law or an applicable International Treaty;
- when the transfer is made to holding companies, subsidiaries or affiliates under the common control of the Controller, or to a parent company or any company in the same group of the Controller operating under the same internal processes and policies;
- when the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data subject, by the Controller and a Third Party;
- when the transfer is necessary or legally required for the safeguard of a public interest, or for the procurement or administration of justice;
- when the transfer is necessary for the recognition, exercise or defense of a right in legal proceedings; and
- when the transfer is necessary for the maintenance or fulfillment of a legal relationship between the Controller and the data subject.
INTERNATIONAL TRANSFERS AND DATA LOCATION
Your personal data may be collected, transferred and stored by Hexagon Data Group and our providers in Colombia, Mexico, Spain, the United States of America and other locations, as necessary for the proper execution and delivery of our services or as required by applicable laws. Although privacy laws may vary between jurisdictions, Hexagon Data Group is committed to protect personal data in accordance with this Privacy Notice, customary industry standards and contractual terms that secure adequate protection of data, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.
DATA RETENTION
We retain personal data for as long as is necessary to fulfill our legal and contractual obligations or in compliance with the blocking period provided by law. After the retention period has expired, we will delete your personal data and, when possible and prior request, we will return it.
MEANS TO EXERCISE YOUR RIGHTS
You may limit or revoke the use, disclosure or consent to the processing of your personal data at any time. When the limitation interferes with the hired service, the processing will continue as authorized until the termination of the service. At any time you may access, rectify, cancel or oppose the use of your personal data (exercise your ARCO Rights). To exercise your rights, please send a request to the email [email protected], that belongs to the area in charge of personal data within Hexagon Data Group. Such request must include the following:
- name of the data subject and address or other means the respond to your request;
- the documents that prove your identity or the legal representation of the data subject;
- a clear and precise description of the personal data on which you wish to exercise the ARCO Rights;
- any other document that assists the location of the personal data; and
- in case of rectification, the documentation that supports your request.
We will inform you of the decision taken within a maximum of 20 (twenty) working days from the date we receive the request. If applicable, we will make it effective within a period of 15 (fifteen) working days from the date we communicate the answer. Under justified circumstances, the above-mentioned deadlines may be extended by equal periods.
CHANGES TO THE PRIVACY NOTICE
We are constantly trying to improve our services, so we reserve the right to change and update this Privacy Notice. The new version will be effective on the date indicated at the beginning of this Notice. In the event we consider that there are substantial changes, we will notify you by posting a visible notice on our website or by any of the available means of communication. As the effective date it will be deemed to be accepted by you. We suggest constantly review our website during the term of our relationship.
USE OF COOKIES AND OTHER TRACKING TECHNOLOGIES
Our website uses cookies, anonymous identifiers, tags and other technologies to provide our services, ensure they function properly, analyze our performance, carry marketing activities and to personalize your experience. For more information, see our Cookie Policy.
DATA SECURITY
Hexagon Data Group implements appropriate technical and organizational measures to protect the security, confidentiality and integrity of your personal data. We establish and maintain administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. We do not adopt security measures less protective than those that we maintain for the handling of our information.
Security measures include: (a) anonymization and/or pseudonymization of personal data, to the possible extent; (b) we protect the security of your information during transfer to and from Hexagon Data Group websites, APIs, applications, products or services through the use of encryption software and protocols; (c) we create specific access keys for each actor involved in data processing; (d) we adopt internal measures for collaborators who handle data; (e) we make sure that our providers comply with the highest standards of data security and privacy, in accordance with applicable Laws; and (f) we make sure that the contracts held with the Processors include clauses that clearly establish their duty to guarantee the security and privacy of the personal data.
ADDITIONAL NOTICES
CHILDREN
At Hexagon Data Group, we do not collect personal data from children under the age of 18 years. If you are a minor and for any reason you gave us such information, upon learning thereof, we will immediately delete your personal data. If you believe that personal data about a minor may be within our records, please contact us by email at [email protected].
DATA PROTECTION OFFICER (GDPR)
Itzayana Tlacuilo has been appointed by the company to supervise how we process personal data, as well as to inform and advise the employees about their obligations regarding data protection. To contact her please send an email to [email protected].
ADDITIONAL INFORMATION FOR COLOMBIA
If you reside in Colombia and/or have a business relationship with Hexagon Data Group in Colombia, we indicate as our address to hear and receive notifications related to this Notice, the one located at 98 # 22-64 P 12, Bogotá D.C., Colombia; telephone +57 3123403064.
We undertake to act under the legal guidelines and as provided by the applicable rules, in particular the Law 1581 of 2012, the Decree 1377 of 2013 and other rules that modify, supplement or repeal them, relating to the processing of personal data carried out in Colombian territory or when the Controller or Processor not established in national territory is subject to Colombian law under international standards and treaties.
In addition to the rights mentioned in the section “MEANS TO EXERCISE YOUR RIGHTS”, the data subject may request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing. Therefore, Hexagon Data Group requests that the owners give their express consent, through any means, before sharing their data with the Company. We are committed to put at your disposal different mechanisms to make this right effective, however, if the data subjects do not give their explicit consent and still make available their personal data, then they release Hexagon Data Group from this requirement.