Legal
Privacy policy
Last updated 16 October 2026
This policy explains what personal information [Hexilia legal entity name] (“Hexilia”, “we”) collects through hexilia.com, why, how long we keep it, who we share it with, and the rights you have. It covers the website only; the Hexilia Farm platform and mobile application have their own terms and privacy notice for customers.
Who is responsible
The data controller is [Hexilia legal entity name], [legal form, e.g. Delaware corporation], registered at [Street address], Delaware, USA (registration number [Company registration number]), with offices in the USA (Delaware) and Tunisia. Contact us about privacy at privacy@hexilia.com. [If Hexilia has appointed a data protection officer or an EU/UK representative, give their contact details here. Only required in specific circumstances.]
What we collect and why
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Contact form | Name, business email, company (optional), inquiry type, message | Answer your inquiry and route it to the right person | Legitimate interests (Art. 6(1)(f)); steps prior to a contract where relevant (Art. 6(1)(b)) | Up to 12 months after the last exchange, unless it becomes a customer relationship |
| Demo request | Name, business email, company, role, and the optional details you choose to give | Arrange and prepare a demo; send a confirmation; follow up | Steps at your request prior to a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Up to 12 months, unless it becomes a customer relationship |
| Newsletter | Email, first name (optional), language, subscription source, consent wording and version, consent and confirmation timestamps | Send the updates you asked for; keep proof of consent | Consent (Art. 6(1)(a)), withdrawable at any time | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep only a one-way fingerprint of your address and the consent record |
| Privacy requests | Name, email, request type, region, details | Handle your request and keep a record that we did | Legal obligation (Art. 6(1)(c)) | Up to 12 months after closing the request, or longer where the law requires |
| Analytics (only with consent) | Pages viewed, approximate location derived from IP, device and browser type, referring site, a pseudonymous identifier stored in cookies | Understand how the site is used and improve it; measure form conversions (without form content) | Consent (Art. 6(1)(a) and the ePrivacy rules on cookies) | Google Analytics data retention set to [2/14] months |
| Security and operation | IP address and request metadata in server logs; rate-limiting counters | Keep the site secure and available; prevent abuse of forms | Legitimate interests (Art. 6(1)(f)) | Server logs up to [30] days; rate-limit counters for minutes only |
We never put the content of form messages, names or email addresses into analytics events.
Who we share it with
We use service providers that process data on our behalf under data processing agreements:
- Website hosting: [Hosting provider name and address].
- Transactional and newsletter email: [Email provider, e.g. Resend, Inc.].
- Analytics, only if you consent: Google Ireland Ltd / Google LLC (Google Analytics 4). Advertising features and Google Signals are switched off.
- Bot protection on forms, if enabled: Cloudflare, Inc. (Turnstile).
We do not sell personal information and do not share it for cross-context behavioural advertising.
International transfers
Hexilia operates from the United States and Tunisia, and some providers may process data in other countries. Where data from the EEA, UK or Switzerland is transferred, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. Tunisian data-protection law (Organic Law No. 2004-63) also applies to processing carried out in Tunisia. [Confirm per provider and with counsel.]
Your rights
Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Residents of California and other US states with privacy laws may have rights to know, delete, correct and opt out of sale or sharing, and not to be discriminated against for using them.
To exercise a right, use our privacy request form or email privacy@hexilia.com. We may need to verify your identity. You may use an authorised agent where the law allows. You also have the right to lodge a complaint with your data protection authority (for example the CNIL in France or the INPDP in Tunisia).
Global Privacy Control
We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing, and we never enable advertising technologies while it is present.
Cookies
See our cookie policy. You can change your choice at any time from .
Security
We use HTTPS throughout, validate every form on the server, rate-limit submissions, restrict access to submissions to the staff who need them, keep secrets out of source code and apply security updates promptly. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
Children
This website is intended for professionals and is not directed at children. We do not knowingly collect personal information from children under 16.
Changes
We will update this policy when our practices change and show the date of the latest version at the top of the page.