This Personal Data Processing Policy sets out the general rules applicable to nanoHexalia under Colombian personal-data protection law, particularly Law 1581 of 2012 and its implementing and supplementary rules.
Effective date: 2026-09-27 · Version: 2026-09-27.1
1. Controller, scope and contact channels
nanoHexalia applies this policy to processing it performs as controller in connection with its websites, subdomains, products, software, applications, APIs, professional services, support, research, development, innovation, education and training. Where it acts as processor on behalf of a customer, applicable documented instructions and specific agreements also apply.
Privacy and data-protection channel: [email protected]. General contact: [email protected] · +57 3023057715.
2. Processing principles
Processing will observe, as applicable, the principles of lawfulness, purpose limitation, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality, together with necessity, proportionality and accountability where required by the nature of the processing.
3. Categories of data and data subjects
- Identification, contact, general location, company, role and professional-relationship data.
- Contractual, commercial, transactional and billing data where applicable.
- Operational data, files, documents, messages and content lawfully provided to a solution.
- Technical session, device, security, log and usage data.
- Data related to training, research, suppliers, partners, collaborators and support, as applicable.
4. Purposes
- Provide, configure, maintain, support and improve products, services and platforms.
- Manage users, authentication, security, auditing, continuity, fraud or abuse prevention and traceability.
- Manage commercial and contractual relationships, support, scheduling, billing, payments and requests.
- Perform operational, statistical and quality analysis and produce metrics, reports or recommendations compatible with the service purpose.
- Conduct research, development, innovation and technology-transfer activities where there is a lawful basis and appropriate safeguards.
- Manage education and training, including participation, assessments, follow-up and certification where applicable.
- Comply with legal, regulatory, accounting, tax, security and rights-defense obligations.
5. Authorization and other lawful conditions
Where authorization is required by law, it will be requested in advance and in an informed manner through physical, electronic or digital means that allow evidence to be retained. Processing may also be permitted by law without authorization or arise from a contractual or legal relationship or from controller instructions where nanoHexalia acts as processor.
6. Sensitive data and minors
Processing of sensitive data is optional for the data subject where the law so provides and requires enhanced safeguards. Data relating to children and adolescents will only be processed where there is a lawful basis and their prevailing rights and best interests are respected.
7. Artificial intelligence, profiling and automated decisions
Where artificial-intelligence or automated systems process personal data, controls appropriate to the context, purpose and risk will apply. Privacy by design, minimization, security, traceability, necessity and proportionality assessment, and human review where decision impact warrants it will be pursued.
8. Transfers, processing arrangements and processors
nanoHexalia may share or make data available to providers or partners where necessary for an authorized or lawful purpose. Where a third party processes data on behalf of nanoHexalia, applicable processing, confidentiality and security conditions will be established. International transfers or processing arrangements will be handled under the applicable regime.
9. Data-subject rights
- Know, update and correct their personal data.
- Request evidence of authorization where applicable.
- Be informed about how their data has been used.
- Submit inquiries and complaints and request deletion or withdrawal of authorization where legally applicable.
- Access their data free of charge in the cases provided by law.
- Refer matters to the Colombian Superintendence of Industry and Commerce when applicable procedural requirements have been met.
10. Inquiries and complaints
Inquiries will be answered within a maximum of ten (10) business days after receipt. If it is not possible to respond within that period, the reason for the delay and the new response date will be communicated, which may not exceed five (5) additional business days.
Complaints will be handled within a maximum of fifteen (15) business days from the day following receipt. Where this is not possible, the reason and the new response date will be communicated, which may not exceed eight (8) additional business days. Requests may be sent to [email protected] and should include identification of the data subject, a description of the request, contact information and relevant supporting materials.
11. Security, incidents and retention
nanoHexalia applies reasonable and proportionate measures to protect information and manages security incidents according to their nature, impact and applicable obligations. Data will be retained for the period needed for the purpose, legal or contractual obligations, defense of rights, continuity, auditing and security, and will then be deleted, anonymized or otherwise handled as appropriate.
12. Effective date and relationship with other documents
This policy takes effect on the date shown above and remains in force while nanoHexalia carries out processing within its scope. It is supplemented by the Privacy Policy, the General Terms and Conditions, contracts, data-processing agreements, privacy notices and applicable specific terms.