Privacy Policy

Last updated: September 28, 2026

1. Definition of Roles and Scope

  • Data Controller: Both parties acknowledge that the Client's database may contain personal data, for which the Client is the sole controller.
  • Data Processor: Insight Decima S.A. de C.V. (hereinafter, "Decima") acts as a data processor when the Client so indicates through the use of the Decima Ecosystem services.
  • Decima Ecosystem: This policy covers all modules, including but not limited to: Ecommerce, CRM, ERP, WMS, POS, IAM, Analytics, and AI services.

2. Personal Data Processing

Decima is contractually committed to:

  • Processing personal data solely and exclusively under the Client's instructions and for the purpose of performing the Services under the agreement.
  • Ensuring that all personnel authorized to process personal data are formally committed to confidentiality.
  • Notifying the Client immediately upon discovery and confirmation of any incident regarding unauthorized access or disclosure of data.

3. Security and Safeguard Measures

To ensure the integrity and availability of information within our infrastructure, we implement:

  • Communication Encryption: All access is protected with Grade A SSL (HTTPS) communication encryption.
  • Backup Service: An automatic daily backup of the Client's database is performed and kept for a period of 7 days, ensuring the last 7 days are always available.
  • High Availability Infrastructure: Servers maintain 99.9% optimal uptime and feature regularly tested disaster recovery plans.

4. Confidentiality

  • Definition: All information related to business, developments, "know-how," customers, and suppliers is considered Confidential Information.
  • Duration: This confidentiality obligation remains in effect during the term of the agreement and after its termination.
  • Compelled Disclosure: Information will only be disclosed if required by law, following prior notice to the Client to the extent permitted by legislation.

5. Client Rights and Data Deletion

  • Audits: Decima will provide the Client with the necessary information to demonstrate compliance with data protection legislation and will contribute to audits if required by the Client.
  • Termination: Upon termination of the agreement, Decima will permanently delete all copies of the database in its possession or return them in their entirety at the Client's choice.

6. Messaging and Artificial Intelligence Agents (Instagram, Messenger and WhatsApp)

When a Client business connects its Instagram account, Facebook Page (Messenger) or WhatsApp number to Decima, an Artificial Intelligence agent answers the messages people send to that business. In this service:

  • Data we receive from Meta: the person's identifier on the platform (or their phone number on WhatsApp), their name and profile picture when the platform provides them, and the content of the messages they send to the business (text, voice notes, images and other files), together with the business's replies.
  • What we use it for: only to answer those conversations on the business's behalf, hand them over to a person on its team when needed, and show the team the history. Voice notes are transcribed to text so they can be answered.
  • What we never do: we do not sell this data, we do not use it for advertising, we do not share it with third parties for their own purposes, and we do not use it to train Artificial Intelligence models.
  • Providers that process it on our behalf: Microsoft Azure OpenAI (generating replies and transcribing voice notes) and Amazon Web Services (hosting and storage). Message files are kept in private storage and are never public.
  • Controller and retention: the business the person chats with is the controller of that data and Decima processes it on its behalf (section 1). It is kept while the business keeps the service and deleted when it ends, under section 5.
  • Deletion: anyone can ask us to delete their conversations by following the instructions at decima.la/data-deletion.

7. Support and Privacy Contact

For any requests related to data protection, the Client may directly contact: soporte@decima.la.