This is an English translation of our Spanish-language privacy notice, provided for convenience. If the two versions differ, the Spanish version at www.imberion.com/privacidad.html prevails.
1. Who is the data controller
Rodrigo Garrido Espíndola, an individual registered for business activity in Mexico who operates under the trade name Imberion ("Imberion", "we"), with address at Privada Jacarandas 5, Bosque Real, Huixquilucan de Degollado, State of Mexico, ZIP 52774, Mexico, is the controller of the personal data described in sections 2(a), 2(b) and 2(c) of this notice, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the "Law").
The person designated to handle any matter related to this notice or to your personal data, including requests to exercise your rights, is Rodrigo Garrido Espíndola, at privacidad@imberion.com.
2. What data we process and where it comes from
a) People who contact us or book a meeting through www.imberion.com, by email, by WhatsApp or in person: name, email address, phone number, company, job title and the content of their messages, including conversations with our automated assistant and with our demonstration agents. Our WhatsApp number is answered by an automated assistant powered by artificial intelligence. During a demonstration, the agent may ask you for a document, such as the declarations page of an insurance policy, and reads it with artificial intelligence to show you how it works. Before asking, it tells you what it will use it for. We extract only the data the demonstration uses (for example, insurer, policy number, policyholder and term), and we do not keep the image or the file. The extracted data, and the agent's replies that mention it, are kept with the demonstration conversation, for the period that section 8 sets for contact data. If you send it after receiving that explanation, you authorize us to read it for that purpose.
b) Clients and their staff: contact and billing data (name, tax ID, tax address, email and phone number) and the information we exchange during the working relationship, including meeting recordings when agreed.
c) Website visitors: technical browsing data (pages visited, referring page, device type, operating system and browser, approximate location) and, if you submit the contact form, the link between your visits to the site and the data you entered in the form. See section 9.
For the purposes in items (a), (b) and (c) we do not request sensitive personal data. Please do not share it through these channels. We do not request information about your health in the documents you send us during a demonstration, and the system is designed not to extract or keep it even if the document contains it.
d) People we speak or exchange messages with while providing a service to a client: phone number or WhatsApp identifier, name if the person provides it, voice recording, transcript and content of phone and messaging conversations, and any data the person shares in them. These conversations are carried out by AI voice and text agents that we operate on behalf of our clients, in customer service and follow-up by phone and WhatsApp, training of sales and service teams, market research and mystery shopping studies (section 4). In in-store training services, we also record the voice of the client's staff with an audio device they wear during their shift, with their written authorization. From their conversations with store customers we only retain the purchase intent, without the customer's voice.
For item (d), Imberion acts as a data processor: it processes the data on behalf of the client that hires the service and only according to its instructions. The client is the controller with respect to those people and is responsible for providing them with its own privacy notice, which sets out its purposes. Section 5 explains what we do with that data.
Depending on the client's industry, those conversations may contain sensitive personal data, such as health information, or financial data. We process them only according to the client's instructions and with the security measures described in section 8.
3. What we use the data for when we are the controller
These purposes apply to the data in sections 2(a), 2(b) and 2(c).
Necessary purposes for your relationship with us. They do not require your consent because they arise from the legal relationship between you and Imberion or from a legal obligation:
- Responding to your messages, scheduling and following up on meetings, and giving you access to the demonstrations of our agents that you request, with a record of their use (access code used, number it was used from, date and number of messages).
- Preparing proposals, entering into and performing service agreements.
- Invoicing and complying with tax and legal obligations.
- Keeping our systems secure and running.
Secondary purposes, which require your consent and which you may refuse without affecting your relationship with us:
- Sending you information about our services, publications and event invitations.
- Measuring use of the website and linking your visits to the contact data you gave us, to improve the site and for commercial follow-up.
If you do not agree with purposes 5 or 6, write to privacidad@imberion.com with the subject "Secondary purposes", at any time. You can also unsubscribe using the link included in each informational email and disable cookies as explained in section 9.
4. Mystery shopping studies
This section applies only to our mystery shopping service and to no other Imberion service. Some clients hire us to evaluate how points of sale or suppliers in a market serve their customers (mystery shopping studies). In these studies an agent contacts the business as a prospective customer and records the commercial information it receives: availability, prices, response times and quality of service.
The subject of the study is the business's service. The agent does not ask the person who answers for personal data. Results are delivered to the client aggregated by business or point of sale, and deliverables do not include the name or voice of the person who answered, so they do not allow anyone to identify individuals or make decisions about them. Recordings from this service are deleted within 90 days after the study is delivered.
5. Data we process as a processor
With respect to the data in section 2(d):
- We process it only to provide the contracted service to the client and according to its instructions.
- We do not use it to send Imberion advertising, to measure the website or to train artificial intelligence models.
- When the client instructs us, we use its conversations to build practice cases for training its own sales or service team.
- We keep it for the period set in the agreement with the client and, when the service ends, we return or delete it as the client instructs.
6. Who we share data with
Service providers (processors). To operate we use providers of cloud infrastructure and databases (Fly.io, Neon, Vercel), email and documents (Google Workspace), customer relationship management and forms (HubSpot), scheduling (Zcal), telephony (Twilio), messaging (WhatsApp Business by Meta), speech transcription and synthesis (Deepgram, ElevenLabs), artificial intelligence models, both from external providers and models we run on our own equipment, and meeting recording and transcription (Fathom, Plaud). Some of them are located or process data outside Mexico, mainly in the United States and the European Union. They process data only to provide their service to us, under confidentiality and security obligations. Disclosing data to a processor is not a transfer and does not require your consent.
Delivery to the controlling client. The data in section 2(d) is delivered to the client that hired the service, because it is the controller. That delivery is not a transfer either.
Transfers. We do not sell personal data. We only transfer personal data to third parties in the cases where the Law allows it without your consent: to competent authorities when a law or treaty provides for it, when necessary for the prosecution or administration of justice, or when necessary to establish, exercise or defend a right in legal proceedings. We do not carry out transfers that require your consent. If we wished to do so in the future, we would update this notice and ask for your acceptance before transferring.
7. Your rights and how to exercise them
You may access your data, ask for it to be rectified if it is inaccurate or incomplete, ask for it to be cancelled (deleted from our records) or object to its processing (ARCO rights). You may also revoke your consent or limit the use of your data.
Send your request to privacidad@imberion.com including:
- Your name and an email, address or other means to reply to you.
- A document proving your identity or, where applicable, the identity and authority of the person acting on your behalf.
- A clear description of the data on which you wish to exercise your right (not needed if you request access).
- The right you wish to exercise or what you are requesting.
- Any information that helps locate the data (for example, the phone number from which you received a call or the WhatsApp number you chatted with).
If you request rectification, state the change to be made and attach the supporting document.
To revoke your consent or ask us to delete your data, use the same email with the subject "Revocation" or "Data deletion". We will confirm through the same channel when it has been completed. Revocation has no retroactive effect. If any data is needed to comply with a legal obligation or a current agreement with you, we will explain this in our reply.
We will communicate our response within a maximum of 20 business days from receipt of your request and, if it is granted, we will carry it out within the 15 business days following the date of the response. When justified by the circumstances, each period may be extended once for an equal period. We will reply through the same channel through which we received your request. If you request access, we will provide your data as electronic documents or plain copies, after verifying your identity. Exercising these rights is free of charge; only the cost of reproduction, copies or delivery may be charged.
If your data was processed by Imberion as a processor for a client (section 2(d)), we will inform you that the controller is the client and forward your request to that client to handle. For training services we will tell you which client it is; for mystery shopping studies we do not disclose the client's identity, but we do forward your request.
8. How we protect the data
We apply administrative, technical and physical measures to protect data against damage, loss, alteration, destruction, or unauthorized use, access or processing. These include encryption of communications, separation of each client's information in our databases, credential-restricted access and retention limited to the time required by the purpose or set by the client agreement. Everyone involved in the processing is bound by confidentiality, even after their relationship with Imberion ends.
Retention. Contact data with no business relationship: up to 24 months from the last contact. Billing data: the period required by tax regulations. Recordings and transcripts in section 2(d): the period set in each client agreement and, for mystery shopping studies, the period in section 4.
9. Cookies and similar technologies
The website www.imberion.com uses two measurement tools:
- Vercel Web Analytics, which records in aggregate the page visited, the referring page, approximate country and region, device type, operating system and browser. According to its provider, it does not use cookies: it distinguishes visits with a value computed from the request, which is discarded after 24 hours. We use it for purpose 6.
- HubSpot tracking code, loaded on the website and in the contact form. It uses cookies to recognize your browser, record the pages you visit and, if you submit the form, link those visits to your contact data. We use it to record your request (purpose 1) and for purpose 6.
You can block or delete cookies in your browser settings. If you block them, the site still shows its content; the contact form might not work, in which case you can write to privacidad@imberion.com.
10. Changes to this notice
We will publish any change at www.imberion.com/privacidad.html, with the last-updated date at the top of the document. If the change affects the purposes or the transfers, we will also notify it by email to the clients and contacts with whom we have a current relationship.
11. Authority
If you believe your right to the protection of your personal data has been violated, you may file a data protection request with Mexico's Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within the 15 business days following the date on which we communicate our response, or after the response period expires if you receive none.