Privacy Notice

Draft under legal review. This is not legal advice.

In compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), Alfredo Márquez Gutiérrez, a sole proprietor registered in Mexico, with address at Av. Eugenio Garza Sada s/n, Int. 216, Col. Cerro Gordo, C.P. 37129, León, Guanajuato, México and tax ID MAGA860609GZ7, makes this Privacy Notice available to you.

1. Controller and processor

For the data of prospects who contact us (for example, through the access-request form), Ixegora acts as the data controller.

For the data client organizations load into the platform (employees, students, staff and the content of reports), the client organization is the controller and Ixegora acts solely as processor, handling the data per their instructions.

2. Data we process

From prospects: organization name, contact name, email, phone, approximate number of users and any message you send us.

From platform users: the identification and contact data the organization loads, plus the content of reports. In Companies mode the report retains no data directly identifying the person submitting it; see section 4.

3. Purposes

Prospect data is used to contact you, confirm your plan, onboard your organization and coordinate payment.

Platform data is processed to provide the report-management service per the client organization's instructions.

4. Anonymity in Companies mode

By design, an anonymous report does not keep the name, account, email or any pseudonym of the person submitting it. Towards the organization's administrators this separation is irreversible and no function of the product can undo it. We do not claim that it is technically impossible for Ixegora to identify a person, for example from the access logs of our hosting providers.

Reports in which the person chooses to identify themselves retain, for the sole purpose of detecting repeat reports from the same source, a technical pseudonym derived from their account through a cryptographic function. Under applicable law that data is pseudonymized rather than anonymous information.

Ixegora holds custody of the key that generates it and undertakes not to use it to re-identify a person, nor to allow a third party to do so, except upon a duly founded request from a competent authority. The key is kept separate from the database and its use is restricted.

5. Minors' data (Schools mode)

Processing of data of minor students is carried out on behalf of and under the responsibility of the school, which must hold parental or guardian consent as required by applicable law.

Ixegora applies heightened confidentiality measures to this data and processes it solely for the care and follow-up purposes defined by the school.

If the reporter chooses that the school not see their name, Ixegora keeps the link between the report and the account, does not show it to the school, and discloses it only upon a duly founded request from a competent authority.

6. Transfers and providers

To operate the service we rely on infrastructure providers (for example, cloud hosting) that act as sub-processors and are contractually bound to protect the data. We do not sell or trade personal data.

Card payments are processed directly by our payment processor, which receives the card details; Ixegora does not receive or store them. We share the organization's name and email with it so it can send receipts.

7. Service through third parties

Some client organizations entrust the handling of their reports to an external human resources service provider (an "HR provider") that uses the platform to administer their cases. In that case the provider processes the data on behalf of the organization, which remains the controller, and Ixegora continues to act solely as a processor, as described in section 1.

The provider's staff may view the content of the reports of the organizations it serves, under the same restrictions that would apply to the organization's own staff: an anonymous report is anonymous towards the organization and towards the provider (see section 4).

The provider may share with the organization's management the original text of a complaint or suggestion, without the name, contact details or any other identity data the reporter declared, so that management can follow up on it. Reports of misconduct are never shared. The person who reported can see in their case that it was shared and the follow-up management records.

Ixegora does not provide human resources services or handle cases.

8. Security

We apply technical and organizational measures to protect data, including per-organization isolation, encryption in transit and role-based access control. No system is infallible, but we work continuously to reduce risk.

9. Retention

We retain data for the duration of the service relationship and for applicable legal periods. Prospect data is retained while interest in the service exists or until you request its deletion.

10. Your rights

You have the right to access, rectify, cancel or object to the processing of your data, and to withdraw consent (ARCO rights). If you are in the EU, GDPR rights also apply to you.

To exercise these rights, write to privacidad@ixegora.com. If the data belongs to your employer or school, we will route your request to the relevant controller.

11. Cookies

We use essential cookies for the operation of the site and platform, plus a first-party attribution cookie (non-essential) that records which channel you arrived from on the public site. We do not use advertising or third-party tracking cookies. See our Cookie Policy for details.

12. Changes

We may update this notice. We will publish the current version with its update date on this site.

13. Contact

Data controller: Alfredo Márquez Gutiérrez. Email: privacidad@ixegora.com. Address: Av. Eugenio Garza Sada s/n, Int. 216, Col. Cerro Gordo, C.P. 37129, León, Guanajuato, México.