icn_HexagonData

Privacy Notice

Content

Hexagon Data respects your privacy.

At Hexagon Data we are committed to protect the interests of the data subject and to provide full transparency and clarity regarding the use and treof your data. We work to develop self-regulatory measures that serve as a reference of good practices in the interactive marketing and digital advertising industry. In this regard, we rely on the highest standards set by international leaders such as the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). In other words, we want to create a culture of data processing, personal and non-personal, reflected on how we would like other companies to treat ours.


When we refer to “Hexagon Data,” “we,” “us,” or the “Company,” we mean Hexagon Data, S.A.P.I. de C.V. and its affiliates that process personal data in accordance with the terms of this Notice. The general address to hear and receive notices is Filadelfia 128, Int. 101, Colonia Nápoles, Alcaldía Benito Juárez, 03840, Mexico City, Mexico. If you access from Colombia, please review the specific section addressed below.

Through our business activities we process personal data as (a) Controller and (b) Processor.

a. Hexagon Data may process personal data of customers, users, providers, employees and persons who are in the process of entering into a contractual relationship with Hexagon Data.  In these cases we act as the data Controller (also known as “data responsible”). The collected personal data will be processed in accordance with this Privacy Notice (the “Privacy Notice” or “Notice”).

b. While providing our products and services, we may process data on behalf of our customers who shall be responsible for obtaining consent and complying with applicable laws. In this case, Hexagon Data is the Processor and we process according to the instructions of the controller as well as to the provisions established in our Data Processing Addendums.

The intent of this Privacy Notice is to inform the privacy and data protection policies applicable to the processing of your personal data that we undertake as Controller. We only collect, use and process your personal data as provided and exclusively for the purposes indicated herein. Please read carefully this Privacy Notice which we make available to you in compliance with the Federal Law on the Protection of Personal Data in Possession of Individuals, as well as other applicable laws (the “Law”). 

DATA WE COLLECT AND ITS PURPOSE

When you use our Website (e.g. visitors or Internet users)
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
Cookies to track your activity on our Website. For more information, please read the Cookie PolicyThe Website uses different types of cookies to automatically collect and store information about your usage in order to improve its performance and user experienceThese purposes give rise to and are necessary for our legal relationship. (Necessary purposes)•Consent
•Legitimate interest (for essential cookies)
When you contact us (e.g.: through forms on our website or by e-mail)
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•Company name
•E-mail address
•Telephone
•Country of residence
•Any other information you decide to share with us
•Answer your questions
•Offer a personalized product or service to each client
•Personalize your experience
•Provide technical support
•To maintain communication
These purposes give rise to and are necessary for our legal relationship.
•Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract
•Consent
When you create your user account (“Profile”)
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•Company name
•E-mail address
•Telephone
•Sector which you belong to (e.g. publisher, advertiser, agency)
•Create your profile within any of our platforms
•Give access to your company’s dashboard
These purposes give rise to and are necessary for our legal relationship.•Processing is necessary for the fulfilment of the contract between the your company and Hexagon Data
•Consent
When you share personal data for marketing purposes (e.g. by subscribing to our newsletter or by contacting us on social media)
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•E-mail address
•Telephone
•To establish a business connection (networking)
•To send newsletters or other marketing communications
•To respond to requests and keep ongoing communication
•For direct marketing
These purposes are secondary or accessory in our legal relationship.
•Consent
When we process your job application
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•E-mail address
•Telephone
•Resume (CV)
•Any other information you decide to share with us
•To process and assess your job application
•To consider you as a candidate for the position
•To manage the employment relationship
These purposes give rise to and are necessary for our legal relationship.
•Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract
•Consent
•Legitimate interest (to assess the candidate)
When we process personal data of our providers and partners
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•Company name
•E-mail address 
•Telephone
•Address
•Financial information (when applicable)
•Any other information you decide to share with us
•Maintain contact
•For the fulfillment of the applicable agreement
•Issue invoice(s)
These purposes give rise to and are necessary for our legal relationship.
•Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract
•Legitimate interest (related to the contractual relationship)
When we process personal data of our customers
Type of personal data we collectProcessing purposesPurpose categoryLegal basis
•Full name
•Company name
•E-mail address 
•Telephone
•Address
•Financial information (when applicable)
•Any other information you decide to share with us
•Maintain contact
•To provide our products and services
•For the fulfillment of the applicable agreement
•To offer new products and services
•Issue invoice(s)
These purposes give rise to and are necessary for our legal relationship.
•Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract
•Legitimate interest (related to the contractual relationship)

If you reside or are using the services in Mexico or in any territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for processing personal data, your acceptance of this Privacy Notice will be deemed to be your consent to the processing of your personal data for the necessary purposes detailed in this Notice. You may revoke your consent at any time as provided in the Section entitled “MEANS TO EXERCISE YOUR RIGHTS”.  We do not sell your personal information for intents and purposes of the CCPA.

Provided your explicit consent we may send you notices and advertisements about new products and services, offers, events or information that we think you will find valuable. If you do not wish to receive such promotional information, click on the “Unsubscribe” link included in all the marketing emails and your request will be automatically received. 

SENSITIVE PERSONAL DATA

The personal data considered sensitive is the one which affects the most intimate aspects of the data subject or whose improper use may give rise to discrimination against or entail a great risk. Sensitive data is considered one that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, trade union membership, political opinions or sexual preference.

Hexagon Data does not collect nor process sensitive personal data.

TRANSFER OF PERSONAL DATA

We only transfer your personal data under the following cases:

  • We hire providers for support services necessary to fulfill our services (e.g. system administration and hosting, work management and expert advice among others). We may transfer your personal data to these providers . Hexagon Data holds a written contract with each provider that includes contractual clauses no less protective than those described herein. We hire recognized, market-leading companies that implement high level security measures for the protection of your personal data.

  • According with the Law, the transfer of data does notrequire consent in the following cases:
    • when the transfer is required by the Law or an applicable International Treaty;
    • when the transfer is made to holding companies, subsidiaries or affiliates under the common control of the Controller, or to a parent company or any company in the same group of the Controller operating under the same internal processes and policies;
    • when the transfer is necessary by virtue of a contract entered into or to be entered into in the interest of the data subject, by the Controller and a Third Party;
    • when the transfer is necessary or legally required for the safeguard of a public interest, or for the procurement or administration of justice;
    • when the transfer is necessary for the recognition, exercise or defense of a right in legal proceedings; and
    • when the transfer is necessary for the maintenance or fulfillment of a legal relationship between the Controller and the data subject.

INTERNATIONAL TRANSFERS AND DATA LOCATION

Your personal data may be collected, transferred and stored by Hexagon Data and our providers in Colombia, Mexico, the United States of America and other locations, as necessary for the proper execution and delivery of our services or as required by applicable laws. Although privacy laws may vary between jurisdictions, Hexagon Data is committed to protect personal data in accordance with this Privacy Notice, customary industry standards and contractual terms that secure adequate protection of data, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

DATA RETENTION

We retain personal data for as long as is necessary to fulfill our legal and contractual obligations or in compliance with the blocking period provided by law. After the retention period has expired, we will delete your personal data and, when possible and prior request, we will return it.

MEANS TO EXERCISE YOUR RIGHTS 

You may limit or revoke the use, disclosure or consent to the processing of your personal data at any time. When the limitation interferes with the hired  service, the processing will continue as authorized until the termination of the service. At any time you may access, rectify, cancel or oppose the use of your personal data (exercise your ARCO Rights). To exercise your rights, please send a request to the email [email protected], that belongs to the area in charge of personal data within Hexagon Data. Such request must include the following:

  1. name of the data subject and address or other means the respond to your request;
  2. the documents that prove your identity or the legal representation of the data subject;
  3. a clear and precise description of the personal data on which you wish to exercise the ARCO Rights;
  4. any other document that assists the location of the personal data; and
  5. in case of rectification, the documentation that supports your request.

We will inform you of the decision taken within a maximum of 20 (twenty) working days from the date we receive the request. If applicable, we will make it effective within a period of 15 (fifteen) working days from the date we communicate the answer. Under justified circumstances, the above-mentioned deadlines may be extended by equal periods. 

CHANGES TO THE PRIVACY NOTICE

We are constantly trying to improve our services, so we reserve the right to change and update this Privacy Notice. The new version will be effective on the date indicated at the beginning of this Notice. In the event we consider that there are substantial changes, we will notify you in advance by posting a visible notice on our website or by any of the available means of communication. As the effective date it will be deemed to be accepted by you. We suggest constantly review our website during the term of our relationship.

USE OF COOKIES AND OTHER TRACKING TECHNOLOGIES

Our website uses cookies, anonymous identifiers, tags and other technologies to provide our services, ensure they function properly, analyze our performance, carry marketing activities and to personalize your experience. For more information, see our Cookie Policy.

DATA SECURITY

Hexagon Data implements appropriate technical and organizational measures to protect the security, confidentiality and integrity of your personal data. We establish and maintain administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing. We do not adopt security measures less protective than those that we maintain for the handling of our information.

Security measures include: (a) anonymization and/or pseudonymization of personal data, to the possible extent; (b) we protect the security of your information during transfer to and from Hexagon Data websites, APIs, applications, products or services through the use of encryption software and protocols; (c) we create specific access keys for each actor involved in data processing; (d) we adopt internal measures for collaborators who handle data; (e) we make sure that our providers comply with the highest standards of data security and privacy, in accordance with applicable Laws; and (f) we make sure that the contracts held with the Processors include clauses that clearly establish their duty to guarantee the security and privacy of the personal data.

ADDITIONAL NOTICES

CHILDREN

At Hexagon Data, we do not collect personal data from children under the age of 18 years. If you are a minor and for any reason you gave us such information, upon learning thereof, we will immediately delete your personal data. If you believe that personal data about a minor may be within our records, please contact us by email at [email protected].

DATA PROTECTION OFFICER (GDPR)

Itzayana Tlacuilo has been appointed by the company to supervise how we process personal data, as well as to inform and advise the employees about their obligations regarding data protection. To contact her please send an email to [email protected].

ADDITIONAL INFORMATION FOR COLOMBIA

If you reside in Colombia and/or have a business relationship with Hexagon Data in Colombia, we indicate as our address to hear and receive notifications related to this Notice, the one located at Cr 18 A, No. 103 11, Bogotá D.C., Colombia; telephone +57 3123403064.

We undertake to act under the legal guidelines and as provided by the applicable rules, in particular the Law 1581 of 2012, the Decree 1377 of 2013 and other rules that modify, supplement or repeal them, relating to the processing of personal data carried out in Colombian territory or when the Controller or Processor not established in national territory is subject to Colombian law under international standards and treaties.

In addition to the rights mentioned in the section “MEANS TO EXERCISE YOUR RIGHTS”, the data subject may request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing. Therefore, Hexagon Data requests that the owners give their express consent, through any means, before sharing their data with the Company. We are committed to put at your disposal different mechanisms to make this right effective, however, if the data subjects do not give their explicit consent and still make available their personal data, then they release Hexagon Data from this requirement.