Legal
Privacy notice
Last updated:
At Evalence we take care of your personal data. This notice explains what data we process, what we use it for, who we share it with and how to exercise your rights under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”) and other applicable regulations. This English version is provided for convenience; if it differs from the Spanish version, the Spanish version prevails.
1.Data controller
Evalence, S.A.P.I. de C.V. (“Evalence”, “we” or “us”), with its address at Mazatlan 81, Col. Condesa, C.P. 06140, Cuauhtémoc, Ciudad de México, is the controller of the personal data we collect through the evalence.com.mx website, the Evalence platform and related services (the “Service”).
For anything related to this notice or your personal data, email us at hola@evalence.com.mx.
2.Our role: controller and processor
Evalence is a platform that companies, schools, universities and other institutions (each, an “Organization”) use to create assessments, deliver them to their participants and issue certificates. That is why we process personal data in two capacities:
- As a controller, we process your account data (for example, name, email and password), data about people who visit our website or contact us, and the data needed to operate, protect and improve the Service.
- As a processor, we process on behalf of each Organization the data it uploads or generates in its workspace: the assessments it assigns, its participants' answers and scores, integrity signals and the certificates it issues. In those cases the Organization is the controller: it decides what that data is used for and how long it is kept, and we only process it according to its instructions.
If you take an assessment at an Organization's invitation, we recommend you also read that Organization's privacy notice.
3.Personal data we process
Depending on how you use the Service, we may process the following categories of data:
- Identification and contact: first and last name, email address, profile photo (optional, or the one provided by Google or Microsoft if you sign in with them) and preferred language.
- Demo requests: if you request a demo on our website, your name, email address, phone number and, if you provide them, your company's name and industry.
- Sign-in credentials: your password, which we store protected with a hash function and never in readable form, or the identifier of the Google or Microsoft account you sign in with.
- Organization data: the workspaces you belong to, your role, your groups and, if the Organization records it, an internal identifier (for example, an employee or student number).
- Assessment data: assigned assessments, answers, attempts, dates and times, scores, feedback and certificates (name, what was certified, score, issue and expiry dates, and verification code).
- Technical and integrity data: IP address, browser and device, and the events recorded during an attempt (start, saved answers, leaving the tab, exiting full screen, pasting text and submission), as well as activity and security logs.
- Usage data: when and how often you use the Service (start and last activity of each session, the open workspace, IP address and browser).
- Content you upload: documents (PDF, DOCX or TXT), questions, images, logos and signature images for certificates. These files may contain third parties' personal data; whoever uploads them is responsible for being authorized to do so.
- Communications: the messages you send us and the delivery status of the emails we send you (for example, whether an email bounced).
- Billing (where applicable): if you purchase a paid plan, the tax information needed to issue Mexican tax invoices (CFDI), such as legal name, RFC, tax address and tax regime.
Sensitive data. We do not request sensitive personal data, such as data about health, ethnic origin, religious beliefs or political opinions, and we ask you not to include it in documents, questions or answers. If an Organization decides to process sensitive data through the Service, it is responsible for obtaining the express written consent the Law requires.
4.What we use your data for
Primary purposes, necessary to provide the Service:
- Creating and managing your account, verifying your email and letting you sign in, including with Google or Microsoft.
- Operating workspaces: invitations, roles, groups and automatic joining by email domain when the Organization enables it.
- Generating questions with artificial intelligence from the documents you upload.
- Delivering assessments: enforcing dates, time limits and attempts, saving your answers, grading them and showing you results according to the Organization's settings.
- Recording integrity signals during attempts and making them available to the Organization delivering the assessment.
- Issuing certificates, emailing them to you and letting anyone with the code verify that they are authentic.
- Sending you the Service's own emails: verification, password reset, invitations, assigned assessments, closing reminders, grades and certificates.
- Protecting the Service: preventing fraud and abuse, rate-limiting attempts, detecting unauthorized access and diagnosing errors.
- Answering your support requests and contacting you about your account.
- Contacting you to schedule and give the demo you requested and, where applicable, preparing a proposal for you.
- Invoicing and collecting payment for contracted services, where applicable, and meeting our legal obligations.
Secondary purposes, which are not necessary for the Service but help us improve it:
- Sending you news, product updates, event invitations and marketing communications.
- Inviting you to satisfaction surveys and research about how the Service is used.
- Sending you reminders and tips based on how you use the Service (for example, if you left an assessment in draft or haven’t come back in a while).
- Analyzing, in aggregate, how the Service is used in order to improve it.
If you do not want us to process your data for secondary purposes, email us at hola@evalence.com.mx with the subject “Secondary purposes”. You can also unsubscribe from the link included in every marketing communication. Opting out will not affect your access to the Service.
5.Artificial intelligence
When you generate questions from a document, we extract its text and send it to our artificial intelligence providers to write the questions and review their quality. We only send the content needed for that task.
Evalence does not use your documents, questions or answers to train artificial intelligence models. Our providers process the content to provide their service to us under their API terms of use.
We recommend that you do not upload documents containing personal data or confidential information that the assessment does not need.
7.Your ARCO rights and withdrawing consent
You have the right to access your personal data and learn how we process it; to rectify it if it is inaccurate or incomplete; to cancel it when you believe it is not needed for the purposes in this notice; and to object to its processing for specific purposes. You can also withdraw any consent you have given us and limit the use or disclosure of your data.
To exercise these rights, email hola@evalence.com.mx with the subject “ARCO rights” and include:
- Your name and the email associated with your account, so we can send you our response.
- A copy of your official ID or, if you act through a representative, the document proving that representation.
- A clear description of the data and the right you want to exercise.
- Any document or information that helps us locate your data and, for a rectification, the correction you request with supporting evidence.
We will reply through the same channel within the time limits set by the Law. You can view and correct some data, such as your name, photo and language, directly in the profile section of your account.
If your data is part of an Organization's workspace (for example, the results of an assessment), send your request to that Organization, as the controller. If you send it to us, we will forward it and help the Organization handle it.
Withdrawing your consent or cancelling your data may prevent us from continuing to provide the Service, and in some cases we may not be able to fulfil your request immediately because a legal obligation requires us to keep certain data.
If you believe your right to the protection of your personal data has been violated, you may file a complaint with the competent authority.
8.How long we keep your data
We keep your data while you have an active account and for as long as needed to fulfil the purposes in this notice and our legal obligations. Assessment data within a workspace is kept according to what the controlling Organization decides.
When a cancellation applies, we block the data and, once the applicable legal periods end, we securely delete or anonymize it. Backups are deleted automatically according to their rotation cycle, currently seven days.
9.How we protect your data
We apply administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, including:
- Encrypted connections over HTTPS.
- Infrastructure on Google Cloud with encryption of data at rest.
- Files in private storage, accessible only through signed, temporary links.
- Passwords protected with hash functions, never stored in readable form.
- Access to information limited by workspace and role, and rate limits to prevent attacks.
- Regular backups.
No system is infallible. If a security breach significantly affects your rights, we will inform you without delay so you can take action.
11.Minors
You must be of legal age to sign up on your own. Minors may only use the Service at the invitation of an educational or training Organization, which is responsible for obtaining the consent of the person exercising parental authority or guardianship, as required by the Law.
12.Consent
By providing your personal data after this notice has been made available to you, you consent to its processing as described here. You can withdraw your consent at any time, as explained in the ARCO rights section.
13.Changes to this notice
We may update this notice to reflect legal changes or changes to the Service or our practices. We will publish the current version on this page with its update date and, if the changes are significant, we will let you know by email or within the Service.
If you have questions about this notice, email us at hola@evalence.com.mx.