Privacy and personal data protection

Who is responsible

Xagair is a brand operated by Mexa SAS, domiciled in Ecuador, and by Mensajea Peru SAC, in Peru. For people in Ecuador, the controller is Mexa SAS. For people in Peru, the controller is Mensajea Peru SAC. For people elsewhere in Spanish-speaking Latin America, Mexa SAS is the controller unless we tell you otherwise when we reply. Commercial contact: info@mexa.cc.

Data protection officer

The data protection officer (delegado de protección de datos) can be reached at privacy@mexa.cc. Use that address for access, rectification, erasure, opposition, portability, limitation of processing, or questions about this policy. We do not publish a street address or tax identification numbers on this site.

Personal data we collect on this site

• Name
• Company
• Work email
• Optional website
• Project objective and description
• Optional system you want to connect
• Technical data needed to run the site: IP address used only for abuse-rate limiting, and a theme preference cookie

What we do not collect here

This form is for a business inquiry. We do not ask for national ID numbers, home addresses, payment data, health data or other special categories of personal data. Please do not send that information in the message field.

Purpose

We use the data solely to evaluate whether a Xagair project is viable, to reply, and to keep a record of the inquiry. There is no pre-ticked marketing subscription and no sale of personal data.

Legal bases in Ecuador (LOPDP)

We process the inquiry on: (1) your consent, given by ticking the acceptance box on the form; (2) pre-contractual steps at your request, when you ask us to assess a possible service; and (3) legitimate interest in answering a business contact and protecting the site against abuse, balanced against your rights. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

Legal bases in Peru (Law 29733)

We process the inquiry with your free, prior, informed, express and unequivocal consent, given by ticking the acceptance box. Processing is also necessary to attend a request you initiate (evaluation of a possible contractual relationship). Consent is not a condition for browsing public pages of this site.

Recipients

The inquiry is handled by the people who operate Xagair at Mexa SAS and, when the contact relates to Peru, at Mensajea Peru SAC. It is delivered to info@mexa.cc or, while the site is in test mode, stored as files on the server. We may use hosting and email providers acting as processors under instructions and a contract. We do not sell personal data or share it for unrelated advertising.

International transfers

Mexa SAS (Ecuador) and Mensajea Peru SAC (Peru) may share an inquiry internally so the right team can reply. That is a cross-border flow between two countries that both have personal-data laws. If a processor hosts the site or mail outside Ecuador or Peru, we require contractual safeguards appropriate to LOPDP and Law 29733. We will update this paragraph if the hosting location is published in more detail.

Retention

We keep the inquiry while we evaluate it and reply, and afterwards only as long as needed to evidence the contact or to meet limitation periods under Ecuadorian or Peruvian law. Test files on the server are deleted when they are no longer needed for operation. We do not write message bodies to public logs.

Security

We apply reasonable technical and organisational measures for a site of this kind: HTTPS where the host provides it, CSRF protection on the form, rate limiting, and restricted storage of inquiries. No measure is absolute; if we become aware of a security incident that affects your data, we will follow the notification duties applicable in Ecuador and/or Peru.

Cookies

The site may store a strictly necessary preference cookie for colour theme (xagair_theme). It is not used for advertising. You can delete it in your browser. We also load a measurement script from mensajea.chat (MEXA stats) to count visits and page use on this website. It is not used to sell advertising to third parties.

Your rights in Ecuador

• Information, access, rectification and updating
• Deletion or elimination
• Opposition and suspension of processing
• Portability, where technically feasible
• Not to be subject to a decision based solely on automated processing that produces legal effects
• To withdraw consent
• To lodge a complaint with the Superintendencia de Protección de Datos Personales

Your rights in Peru (ARCO)

• Access, rectification, cancellation (erasure) and opposition
• Revocation of consent
• To lodge a complaint with the Autoridad Nacional de Protección de Datos Personales (ANPD) at the Ministry of Justice and Human Rights

How to exercise your rights

Write to privacy@mexa.cc from the email you used in the inquiry, stating which right you want to exercise. We may ask you to confirm your identity with a reasonable, proportionate check. We will answer within the time limits of the applicable law (Ecuador LOPDP or Peru Law 29733). You may also write to info@mexa.cc; that mailbox is for commercial inquiries, not a substitute for the officer’s address.

Automated decisions

Sending this form does not produce a fully automated decision with legal effects. A person reviews the inquiry.

Children

This website is aimed at companies. It is not directed at children. If we learn that a child has sent us personal data through the form, we will delete it.

Changes

We may update this policy when the law or the way we operate the site changes. The current version is the one published on this page.