Privacy notice

This notice explains how Simón Capacitación, S.A.P.I. de C.V. ("Simón", "we") handles the personal data of people who visit our site, ask us for information, and contract or administer Simón on behalf of a company. It complies with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, DOF 2025-03-20), its Regulations and the Privacy Notice Guidelines. At the end there are annexes with what applies if you are in Colombia, Chile or Argentina.

1. Who is responsible for your data

• Data controller: Simón Capacitación, S.A.P.I. de C.V. (RFC SCA241220T7A), trading as "Simón".
• Address: Calle Bucarelli 161, interior 16, colonia Juárez, alcaldía Cuauhtémoc, C.P. 06600, Ciudad de México, Mexico.
• Privacy contact: soporte@holasimon.ai.
• Personal data officer or department: Matthieu Dahirel, Simón's privacy officer (section 11).

2. Who this notice applies to, and who it does not

It applies to the data Simón handles on its own behalf, as data controller:

• Visitors to holasimon.ai.
• Prospects who ask us for a demo or for information.
• Our customers' contacts: the people who contract Simón or administer it on behalf of a company (administrators, billing or support contacts).
• People who write to us for support or to exercise their rights.

It does not apply to the data of the people who use Simón for their training at the invitation of their employer or organization ("users"). In that case:

• The organization is the data controller, and Simón handles that data on its behalf and following its instructions, as data processor.
• See your organization's privacy notice.

3. Personal data we handle

• If you are…

  A visitor

  Data

  Browsing data: pages visited, referrer, device and browser type, approximate location derived from the IP address, and cookie identifiers. Measurement and marketing cookies are used only if you accept them (section 12 and Cookie policy)

• If you are…

  A prospect

  Data

  Name, work email, phone and company

• If you are…

  A customer contact

  Data

  Name, email, phone, job title, company and your role in the account. Login credentials (the password is stored with a one-way hashing algorithm). The company's billing data. Activity and security logs of your account. Support communications, including any screenshots you send us

• If you are…

  Someone who writes to us

  Data

  Name, contact details and the content of your request. If you exercise your rights, also the document that proves your identity

Sensitive data. We do not ask you for sensitive personal data. Please do not include it in forms or messages.

Financial or property data. We do not collect it from individuals. We do not currently take card payments within the platform.

4. What we use your data for

4.1 Necessary purposes

They do not require your consent because they are necessary for the relationship you started or that your company has with us (art. 9, sec. IV LFPDPPP):

1. Answering your request for a demo or information, and scheduling and holding the call.
2. Following up commercially on that request: proposals, quotes and service trials.
3. Creating and administering your company's account and its administrators' access.
4. Providing the contracted service, supporting you and telling you about changes to the service, to these documents or to our subprocessors.
5. Invoicing and collecting payment.
6. Protecting the site and the platform: detecting bots, fraud, abuse and security breaches.
7. Complying with legal obligations, responding to requests from authorities and defending our rights.

4.2 Purposes that are not necessary

They are not essential. You can refuse them without affecting the necessary ones:

1. Measuring how the site is used (Google Analytics).
2. Measuring and personalizing our campaigns on Google, Meta, LinkedIn and HubSpot.
3. Asking for your opinion about the service.

How to refuse:

• Measurement and campaigns: the corresponding cookies are not activated until you accept them in the banner. You can withdraw your choice at any time in "Cookie preferences".
• Opinion about the service: write to us at soporte@holasimon.ai and we will stop asking.

4.3 Automated decisions

We do not make decisions about you based solely on automated processing.

5. Who we share your data with

Processors (remissions). These are providers that handle data on our behalf, under contract and only for what we ask of them:

• Vercel: hosts the site, provides cookieless measurement and detects bots.
• HubSpot: prospect and customer management.
• Our email and platform providers.

These communications do not require your consent.

Transfers that require your consent. If you accept measurement or marketing cookies, Google, Meta and LinkedIn receive identifiers and browsing data, which they also use for their own purposes under their privacy notices. By accepting those categories in the banner you consent to that transfer (art. 35 LFPDPPP). If you do not accept them, it does not happen.

Transfers that do not require your consent (art. 36 LFPDPPP):

• To competent authorities, when the law requires it or for the administration of justice (secs. I and V).
• When necessary to establish, exercise or defend a right in legal proceedings (sec. VI).
• To companies in our own group that operate under the same processes and policies (sec. III), should any exist.

We do not sell your personal data.

6. Transfers and storage outside Mexico

Our providers have servers mainly in the United States. We require them by contract to meet the same protection obligations we have.

7. How long we keep your data

• Data

  Prospects

  Period

  Up to 24 months after the last interaction, or earlier if you object or ask for deletion

• Data

  Customer contacts and billing

  Period

  For the length of the relationship, and afterwards for the periods required by tax and commercial laws

• Data

  Rights requests

  Period

  3 years, as evidence that they were handled

• Data

  Cookies

  Period

  As set out in the Cookie policy

When the period ends, we block the data and then delete or anonymize it.

8. How we protect your data

We apply administrative, technical and physical measures:

• encryption in transit;
• role-based access control;
• passwords stored with one-way hashing algorithms;
• rate limits on attempts;
• audit logs;
• confidentiality agreements with our staff and providers.

If a security breach significantly affects your rights, we will tell you immediately what we know and what you can do (art. 19 LFPDPPP).

9. How to limit the use or disclosure of your data

• Adjust your cookie preferences at any time in "Cookie preferences", in the footer.
• Ask us to add you to our exclusion list by writing to soporte@holasimon.ai. From then on we will not use your data for the purposes in section 4.2.

10. Your ARCO rights and withdrawing consent

You can access your data, rectify it, cancel it or object to its processing (ARCO rights, from their Spanish initials). You can also withdraw any consent you gave us. Withdrawing it does not have retroactive effect.

How: send an email to soporte@holasimon.ai with:

1. Your name and an email or postal address where you want the answer.
2. A copy of your official ID. If you act on someone's behalf, also that person's ID and the document that proves you represent them.
3. Which right you want to exercise and over which data (not needed for access).
4. To rectify, the correct data and, where applicable, a supporting document.
5. Anything else that helps us find your data.

Deadlines:

• If your request is incomplete, we will ask you for what is missing within 5 business days. You will have 10 business days to send it.
• We will answer within 20 business days of receiving the complete request.
• If it is granted, we will carry it out within the following 15 business days.
• We may extend each deadline once, by an equal period, when justified (art. 31 LFPDPPP).

How we respond: we will send the answer and, where applicable, the data by email, in a commonly used format.

Cost: exercising your rights is free. If you repeat the request within 12 months, we may charge reproduction costs of up to 3 UMA (art. 34 LFPDPPP).

If you disagree with the answer or do not receive it on time, you can start rights-protection proceedings before the Secretaría Anticorrupción y Buen Gobierno within the following 15 business days (section 14).

If we handle your data on behalf of your organization (you are a user):

• Send your request to your organization.
• If you send it to us, we will forward it and help them answer you.

11. Personal data officer or department

Matthieu Dahirel, Simón's privacy officer, at soporte@holasimon.ai. They receive and handle your requests and promote data protection within Simón (art. 29 LFPDPPP).

12. Cookies and other tracking technologies

We use cookies and similar technologies:

• Type

  Necessary

  What for

  Remembering your privacy choice and protecting the site

  Does it need your consent?

  No

• Type

  Cookieless measurement

  What for

  Visit measurement with Vercel Web Analytics, which uses no cookies and discards the identifier it computes within 24 hours

  Does it need your consent?

  No

• Type

  Measurement

  What for

  Google Analytics

  Does it need your consent?

  Yes

• Type

  Marketing

  What for

  Google Ads, Meta, LinkedIn and HubSpot

  Does it need your consent?

  Yes

Measurement and marketing cookies are off until you accept them. With them, identifiers, pages visited, referrer, device, browser and approximate location are collected.

You can change your choice at any time in "Cookie preferences", in the footer. The details of each cookie and its duration are in the Cookie policy.

13. Changes to this notice

We will publish any change on this page with its new version and effective date. At the end of the page you will find the change history.

If the change affects the purposes or the transfers:

• We will tell you by email, if we have yours, or with a visible notice on the site.
• Where the law requires it, we will ask for your consent again.

14. Authority

The personal data protection authority in Mexico is the Secretaría Anticorrupción y Buen Gobierno, through its Personal Data Protection Unit.

---

Annex A. If you are in Colombia (Law 1581 of 2012)

• This notice, together with the processing policy that forms its main body, complies with articles 13 and 15 of Decree 1377 of 2013.
• Authorization: by submitting the form you authorize the processing for the purposes in section 4.1.
• Your rights: to know, update and rectify your data; to request proof of the authorization; to be informed of its use; to revoke the authorization or request deletion; to access it free of charge; and to file complaints with the Superintendencia de Industria y Comercio once you have completed the process with us.
• Deadlines: inquiries are answered within 10 business days and claims within 15 business days (arts. 14 and 15 of Law 1581).
• Department in charge of requests: Matthieu Dahirel, Simón's privacy officer, at soporte@holasimon.ai.

Annex B. If you are in Chile (Law 19.628, as amended by Law 21.719)

It applies from December 1, 2026, or from the date the law sets if the extension now under discussion is approved (Bulletin 18.623-07).

• Legal bases (art. 13): consent for the measurement and campaigns in section 4.2, which you give in the banner; legitimate interest for asking your opinion about the service and for security; performance of a contract or pre-contractual steps and legal obligation for the purposes in section 4.1.
• Your rights: access, rectification, deletion, objection (including absolute objection to direct marketing), portability and blocking. You can complain to the Agencia de Protección de Datos Personales.
• Contact for data subjects and for the Agency: soporte@holasimon.ai.
• International transfers: to Mexico and the United States, under contractual clauses that provide adequate safeguards.

Annex C. If you are in Argentina (Law 25.326)

• International transfers: to Mexico and the United States, under the model clauses of Disposition 60-E/2016 or of the Ibero-American Network.
• Notice required by Disposition DNPDP 10/2008 (mandatory text, in Spanish): "El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley N° 25.326. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales." (The data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown under article 14, subsection 3 of Law 25.326. The Agency for Access to Public Information, as the oversight body of Law 25.326, handles complaints from anyone whose rights are affected by a breach of the data protection rules.)

Change history

Version	Date	Change
1.0	November 4, 2026	First version. Replaces the previous notice published at /privacy-policy.