Privacy and Personal Data Protection Policy
Information on the processing of personal data under Article 12 of Ecuador's Organic Law on Personal Data Protection (LOPDP).
This document explains how DILEXSA S.A. processes your personal data: what data it collects, for what purpose, on what legal basis, for how long, with whom it is shared, and what rights you have. It is written in plain language so that anyone can understand it.
Need the formal version?
Download the full policy as a PDF (version 2.1).
1. Who processes your personal data?
The company responsible for processing your personal data is:
| Legal name | DILEXSA S.A. |
|---|---|
| Tax ID (RUC) | 0992155736001 |
| Registered address | Mapasingue Oeste, Av. Primera #113, Guayaquil — Guayas, Ecuador |
| Contact email for data protection matters | proteccion-datos@dilexsa-tech.com |
DILEXSA is not required to appoint a Data Protection Officer, as it does not fall under any of the circumstances established by law for that obligation. For this reason, the requirement to provide the contact details of a Data Protection Officer (Article 12, item 9 of the Law) does not apply in this case, as expressly provided by the Law itself. For any matter relating to your personal data, please use the contact email indicated above.
2. What data do we process, and why?
| Activity | Purpose of processing | Data processed |
|---|---|---|
| Personnel management | Comply with labor, social security and tax obligations; process payroll; control access to the premises; manage the employment relationship | Identification and contact data, academic data, financial data (account, salary), employment data, and fingerprint for access control |
| Supplier management | Manage the contractual relationship with suppliers and comply with tax obligations | Supplier identification data, commercial contact data, and financial data |
| Client management | Manage the relationship with business clients, operational and commercial communication, billing and after-sales | Identification and contact data of the individuals acting on behalf of the client, and financial data of the relationship |
| Video surveillance | Ensure the safety of people and property on DILEXSA's premises | Images of people entering DILEXSA's premises |
| Operational communications | Internal and external communication, document storage and collaboration, through digital tools | Identification and contact data and the content of communications |
| Client services (support, deployment, consulting) | Provide technical services on the security systems of end clients | Data that DILEXSA accesses on behalf of the end client, without using it for its own purposes |
3. On what legal basis do we process your data?
Every company needs a legal basis to process personal data. Article 7 of the Organic Law on Personal Data Protection establishes these bases. DILEXSA uses the following, depending on the activity:
| Activity | Applicable legal basis |
|---|---|
| Personnel management | Compliance with a legal labor, social security and tax obligation (Art. 7, item 2). For the fingerprint: your explicit consent (Art. 7, item 1 and Art. 26 of the Law) |
| Supplier management | Compliance with contractual obligations (Art. 7, item 5) and with a legal tax obligation (Art. 7, item 2) |
| Client management | Compliance with contractual obligations (Art. 7, item 5) and with a legal tax obligation (Art. 7, item 2) |
| Video surveillance | DILEXSA's legitimate interest in ensuring the safety of people and property (Art. 7, item 8 and Art. 9 of the Law) |
| Operational communications | Compliance with contractual and legal obligations (Art. 7, items 5 and 2) |
| Client services | DILEXSA acts on behalf of the end client; the legal basis corresponds to that client. DILEXSA's actions are governed by its contract with the client |
4. How long do we keep your data?
DILEXSA keeps your personal data only for as long as necessary to fulfill the purpose for which it was collected. Data protection regulations do not set a single retention period: it is determined by the purpose of each processing activity and by other applicable legal obligations.
For example, labor and tax documentation must be kept for the periods required by tax and labor regulations. Video surveillance images are kept for the time necessary for the security purpose and are then securely deleted, unless a specific segment must be retained as evidence of an incident. Once the applicable period has elapsed, the data is securely deleted.
5. With whom do we share your data?
DILEXSA may share your personal data with:
- Public entities: when there is a legal obligation to do so (for example, the Internal Revenue Service, the Ecuadorian Social Security Institute, or the Ministry of Labor).
- Suppliers that provide services to DILEXSA: companies that process data on DILEXSA's behalf under contract, such as technology and communications service providers. These providers may only use the data to provide their service to DILEXSA.
- Competent authority: when an authority requires it in a duly substantiated manner and in accordance with the law.
International transfers. Some of the technology tools DILEXSA uses for its communications store information on servers located outside Ecuador, specifically in the United States. This means that certain personal data may be subject to an international transfer. DILEXSA applies the safeguards required by data protection regulations for these transfers. The detailed analysis of this transfer is documented internally in accordance with current regulations on international transfers.
6. What rights do you have, and how to exercise them?
As a data subject, the law grants you the following rights over your data:
- Access: to know what data of yours we process and how.
- Rectification and updating: to correct inaccurate or incomplete data.
- Deletion: to request the deletion of your data where appropriate.
- Objection: to object to processing in certain circumstances.
- Portability: to receive your data in a structured, commonly used format where applicable.
- Not to be subject to automated decisions: not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.
- Withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, write to the contact email indicated in Section 1. DILEXSA will respond to your request within the fifteen (15) day period established by the Law, counted from receipt of the request. DILEXSA may ask you to verify your identity before handling the request, in order to protect your own data.
7. Other information the law requires us to give you
- Existence of databases: your personal data is held in databases managed by DILEXSA for the purposes described in this document.
- Origin of the data: most data is obtained directly from you. In the case of individuals acting on behalf of client or supplier companies, some contact data may be obtained from the company with which DILEXSA maintains the business relationship.
- Consequences of not providing the data: if you do not provide the necessary data, DILEXSA may be unable to manage the corresponding employment, contractual or commercial relationship, or to comply with its legal obligations.
- Incorrect or inaccurate data: providing incorrect or inaccurate data may affect the proper management of the relationship and the associated obligations. This is why it is important to keep your data up to date.
- Automated decisions: DILEXSA does not carry out automated assessments or decisions, nor profiling, that produce legal effects on you or significantly affect you.
- Other purposes: if in the future DILEXSA intends to process your data for a purpose other than those described, it will inform you beforehand in accordance with the law.
8. Video surveillance on DILEXSA's premises
DILEXSA operates a video surveillance system on its premises, the purpose of which is to ensure the safety of people and property. When you enter DILEXSA's premises, you may be captured by these cameras.
The legal basis for this processing is DILEXSA's legitimate interest in security (Art. 7, item 8 and Art. 9 of the Law). Images are kept only for the time necessary for the security purpose and are then securely deleted, unless a segment must be retained as evidence of a specific incident. At the points where the cameras operate, DILEXSA posts visible informational signage warning of the video surveillance and referring to this Policy. You may exercise your rights over the images concerning you through the contact channel in Section 1.
9. Processing of special-category data
In the area of personnel management, DILEXSA processes one special-category data point: the fingerprint, used for access control to the premises. The law gives reinforced protection to this type of data.
This processing is carried out on the basis of the employee's explicit consent, in accordance with Art. 7, item 1 and Art. 26 of the Organic Law on Personal Data Protection. Consent is collected through a specific form that clearly explains the purpose. The employee may withdraw consent at any time; in that case, DILEXSA will delete their fingerprint from the system and enable an alternative means of access control.
10. Where and how to file a complaint
If you believe that DILEXSA has not properly processed your personal data or has not properly handled the exercise of your rights, you may:
- Complain to DILEXSA: by writing to the contact email indicated in Section 1. DILEXSA will review your complaint and provide a response.
- Complain to the authority: by filing a complaint with the Superintendence of Personal Data Protection, which is the public authority responsible for overseeing compliance with personal data protection regulations in Ecuador.
11. Changes to this Policy
DILEXSA may update this Policy when its processing activities, purposes, or applicable regulations change. The current version is the one published with its version number and date. We recommend that you review this document periodically.
Short privacy notice
DILEXSA S.A. (RUC 0992155736001) processes your personal data to manage the corresponding employment, commercial or contractual relationship and to comply with its legal obligations, on the legal basis applicable to each case under Article 7 of the Organic Law on Personal Data Protection. Your data may be shared with public entities by legal obligation and with suppliers that provide services on DILEXSA's behalf. Some communications are carried out using tools with storage outside Ecuador, with the safeguards required by law. You may exercise your rights of access, rectification, deletion, objection, portability and others by writing to proteccion-datos@dilexsa-tech.com, and file complaints with the Superintendence of Personal Data Protection.
Last updated: May 3, 2026