Legal — Privacy
Privacy policy
Last updated
How personal data is handled on https://www.hex.co.ma, which cookies are used, for what purposes, and how to exercise your rights.
Introduction
This privacy policy describes how personal data is handled in connection with the website https://www.hex.co.ma.
HEX is a phygital experience platform operated by UPOUI. This policy applies to this website only. Experiences deployed for a client, a brand or a venue are governed by their own terms and their own data notice, shown to participants inside each activation.
Please read this policy carefully. By continuing to browse, you are informed of the processing described below; anything that relies on your consent takes place only once you have agreed to it.
Data controller
The controller of the data collected through this website is UPOUI, publisher of the HEX platform.
For any question about this policy or to exercise your rights, write to contact@upoui.com.
Data we collect
This website has no user account and no personal area. It does provide a contact form, described in section 04. The data that may be processed is as follows:
- Technical connection data — IP address, browser type and version, operating system, browser language, device used.
- Browsing data — pages viewed, date and time of the visit, approximate session duration, referring page, and interactions or events within the pages.
- Your preferences — the language you selected and the cookie choice you expressed.
- Measurement and advertising identifiers — identifiers set by the tools described in sections 07 to 09, only where your consent allows it.
- Information you send us deliberately — what you enter in the contact form, the content of your message when you write to us, and the details you enter if you book a demonstration.
Demonstrations are booked through Calendly, a third-party service outside this website: anything you enter there is collected by Calendly under its own privacy policy and then passed to us so we can arrange the meeting.
Contact form
The website provides a contact form for people who want to talk to us about a project or an activation. Using it is entirely optional: you can also write to us directly at contact@upoui.com.
The information you may enter is the following:
- Name — required.
- Work email address — required, so that we can reply.
- Company or organisation — optional.
- Type of activation — optional, chosen from a closed list (city, event, cultural venue, retail, brand activation, other).
- Description of your project — required; its content is free text and entirely up to you.
No other data is requested: no telephone number, no postal address, no job title, no budget. Please avoid including sensitive or confidential information in your message where it is not necessary for us to understand your enquiry.
Purposes
UPOUI uses this information only to:
- respond to your enquiry;
- understand the context and the project you describe;
- correspond with you about that enquiry;
- keep track of the exchanges that follow from it.
Sending an enquiry is not consent to marketing communications. Information submitted through this form is not added to a mailing list, used for marketing campaigns, or added to an advertising audience. If such a use were ever offered, it would require separate, optional and withdrawable consent.
Recipient and retention
Your enquiry is sent by email to contact@upoui.com. The website has no database: your message is not stored on this site, and it is not passed to any customer-relationship tool. To carry the messages sent through the contact form we use Amazon Simple Email Service (Amazon SES), provided by Amazon Web Services. After sending, your message exists in UPOUI’s professional mailbox and with that delivery provider.
Enquiries submitted through the contact form are retained only for as long as necessary to process the enquiry, follow up on the conversation and, where applicable, manage the resulting relationship. They are then deleted in accordance with the applicable internal retention rules.
Protection against automated submissions
To limit automated submissions, the form applies simple technical measures: a trap field invisible to visitors, a limit on how many submissions can follow one another, and a cap on the size of the data sent. To limit repeated submissions, your IP address is read transiently at the moment of sending in order to derive a hashed, temporary technical identifier; the address itself is neither included in the message we receive nor stored in any database. No third-party bot-detection service is used.
Purposes of processing
The data described above is processed for the following purposes:
- to display the website and keep it working and secure;
- to remember your chosen language and your cookie preferences;
- to measure audience and understand how the site is used, subject to your consent;
- to measure the effectiveness and attribution of our advertising campaigns, subject to your consent;
- to build advertising audiences and send you personalised communications, including remarketing, subject to your consent;
- to answer your enquiries and arrange the demonstrations you request;
- to meet the legal and regulatory obligations that apply to us.
Audience measurement and advertising rely on your consent. The technical operation and security of the site rely on our legitimate interest in providing a reliable website.
Google Analytics
Subject to your consent to audience measurement, we use Google Analytics 4, a service provided by Google, to measure traffic to and use of the site.
The information processed for this purpose includes:
- the number of visits and sessions;
- traffic sources and originating campaigns;
- pages viewed and events triggered;
- device, browser and operating system type;
- performance and conversion indicators.
This data can identify a device or a session through technical identifiers. It is not anonymous, and we do not present it as such. It is processed by Google as a service provider, under its own terms.
Google Ads
Subject to your consent to marketing and advertising, we use Google Ads technologies to:
- measure conversions arising from our campaigns;
- attribute a visit or an action to a specific campaign;
- analyse campaign performance;
- build advertising audiences;
- deliver remarketing messages and personalise advertising, within the limits allowed by your consent and the applicable rules.
None of this is necessary for the site to function. It falls under the “Marketing and advertising” category and is activated only with your agreement.
Meta Pixel and Meta advertising
Subject to your consent to marketing and advertising, we use the Meta Pixel, a tool provided by Meta and formerly known as the Facebook Pixel.
With your agreement, it allows us to:
- measure conversions arising from our campaigns;
- attribute an action to a specific advertisement;
- analyse campaign performance;
- build advertising audiences;
- deliver remarketing messages and optimise our advertising.
The Meta Pixel is not loaded until you have consented to the “Marketing and advertising” category. Until that consent is given, no Meta script runs and no event is sent.
Cookie consent and your choices
On your first visit, a banner lets you accept all cookies, reject them all, or customise your choice by category. Rejection is offered just as directly as acceptance.
Until you express a choice, only necessary cookies are set: audience measurement and advertising remain disabled by default.
Your choice is stored in a dedicated cookie, separate from the one that remembers your language. It records the version of the consent mechanism, your decision for each category and the date of that decision. It contains no identifying data and is kept for no more than six months, after which you are asked again.
You can change or withdraw your consent at any time using “Manage cookies” at the foot of every page. Withdrawing consent stops the relevant processing going forward; it does not affect the lawfulness of processing carried out beforehand, and it cannot by itself erase data already held by the providers concerned. You can also configure your browser to refuse or delete cookies.
Remarketing and advertising audiences
Where you consent to it, the tools described in sections 08 and 09 allow us to build audiences from your browsing on this site and then address advertising messages to you on Google and Meta platforms.
This relies on technical identifiers associated with your device or browser. It does not involve any automated decision producing legal effects concerning you.
These features belong exclusively to the “Marketing and advertising” category and are never activated merely because you visited the site.
Technical logs and security
Like any site on the internet, this one is served by hosting infrastructure that records technical logs. Those logs ordinarily contain the IP address the request came from, the resource requested, the date and time, the referrer and the information sent by the browser.
These records are part of the normal operation of an online service. They are used to deliver pages, keep the site available, diagnose faults and detect abuse or intrusion attempts. They are not used for audience measurement or advertising, and are not combined with data from the tools described in sections 07 to 09.
Service providers and recipients
Your data is not sold, rented or traded. It may be disclosed to the following categories of recipient:
- Our hosting provider, which serves the site and keeps the technical logs mentioned in section 12.
- Google, for audience measurement and advertising technologies, where you have consented.
- Meta, for advertising technologies, where you have consented.
- Calendly, when you book a demonstration.
- Amazon Web Services (Amazon Simple Email Service), for carrying the messages sent through the contact form.
- The competent authorities, where the law requires it or to establish and defend our rights.
Our providers act only within the scope of the service entrusted to them and are bound by confidentiality and security obligations.
International data transfers
Google, Meta and Calendly are international providers. Where you consent to their technologies, the corresponding data may be processed and stored on infrastructure located outside Morocco, in particular in the United States and the European Union.
Messages sent through the contact form are carried by Amazon Simple Email Service (Amazon SES). The service is configured in an Amazon Web Services region located in the United States, so the information you enter in the form may be processed in the United States while it is being delivered.
Law No. 09-08 on the protection of individuals with regard to the processing of personal data governs transfers of data abroad. We rely on the contractual guarantees and confidentiality commitments offered by these providers, and we complete the formalities required with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) for the processing that calls for them.
If you would like details of the transfers involved in a specific processing operation, write to us at contact@upoui.com.
Data retention
Data is kept only for as long as necessary for the purposes for which it was collected, then deleted or archived in line with the applicable legal obligations.
- Your cookie choice — kept for no more than six months from the moment you express it. After that, you are asked again.
- Language preference — kept until you change it or clear your browser cookies.
- Data collected through cookies — personal data collected by means of cookies, including for audience measurement and advertising, is not kept for longer than six months. At the end of that period it is deleted or anonymised. The retention settings of the services concerned are configured accordingly.
- Correspondence and demonstration requests — kept for as long as needed to handle your request and the relationship that follows, then as a record for the period required.
- Technical logs — kept for the period necessary for security and diagnosis, in line with the periods applied by our hosting provider.
Data security
The site is served over an encrypted connection (HTTPS). It is an informational website: it has no user account and no visitor database.
The correspondence you send us and your demonstration requests are protected by the security and access controls of our providers, and access is limited to the people who need it. As no arrangement can guarantee absolute security, please do not send us sensitive information by email.
Your rights
In accordance with Law No. 09-08, you may in particular exercise your rights of access, rectification and objection:
- Right of access — to obtain confirmation that data concerning you is processed, and to be given a copy of it.
- Right of rectification — on the conditions set out by the law, you may request the updating, rectification, erasure or blocking of data whose processing does not comply with the law, in particular where that data is incomplete or inaccurate.
- Right to object — to object on legitimate grounds to the processing of your data, and without having to give a reason where direct marketing is concerned.
Separately from those rights, where processing is based on your consent — as it is for audience measurement and advertising — you may withdraw that consent at any time from “Manage cookies”, without affecting the lawfulness of processing carried out beforehand.
These rights are exercised by writing to contact@upoui.com. We may ask you for proof of identity where that is necessary to handle your request safely.
You may also refer the matter to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), the authority responsible for personal data protection in Morocco.
Third-party websites and services
This site links to services we do not operate, in particular Calendly for booking, LinkedIn and the UPOUI website, as well as to experiences deployed on the HEX engine.
Once you follow one of those links, the processing carried out is governed by that service’s privacy policy and not by this one. We encourage you to read it.
Changes to this policy
This policy may be amended to reflect changes to the site, to the tools we use or to the applicable rules. The version in force is the one published on this page, and the date at the top of the document shows when it was last updated. If the cookie categories change materially, your consent will be requested again.
Contact
For any question about this policy, your data, or to exercise your rights:
- Publisher
- HEX, by UPOUI
- contact@upoui.com
- Terms
- Terms & conditions