🛡️ Privacy Policy for the “¡Hola Ociel!” Comprehensive University Assistance Platform

By using our services, you entrust us with your data. We understand this is a significant responsibility and we strive to protect your information and provide you with control over it.

The purpose of this Privacy Policy is to inform you about what data we collect, why we collect it, and how you can update, manage, and delete it.

1. Introduction and Data Controller

This Privacy Policy describes how the Universidad Autónoma de Nayarit (UAN), through its Dirección General de Sistemas (DGS) and under the supervision of the Transparency Unit (UT), collects, uses, protects, and processes the personal data of users who interact with the support channels of the “¡Hola Ociel!” Comprehensive University Assistance Platform.

The Universidad Autónoma de Nayarit, a non-profit public institution of higher and upper-secondary education, with legal domicile in the capital of the state of Nayarit, Ciudad de la Cultura “Amado Nervo” S/N, C.P. 63000, Tepic, Nayarit, México, is the data controller responsible for the personal data collected, used, and protected in the use of the “¡Hola Ociel!” application and the OcielWoot! support platform, in compliance with the General Law on the Protection of Personal Data Held by Obligated Parties (LGPDPPSO) and other applicable legal provisions.

This policy clearly establishes the affiliation between the “¡Hola Ociel!” integration application, registered with Meta for Developers, its owner and operator—the Universidad Autónoma de Nayarit—and the institutional platform “OcielWoot!”, used as the central request management system.

To exercise ARCO rights or obtain additional information, the data subject may contact the Transparency Unit by email at transparencia@uan.edu.mx or by phone at +52 (311) 211 8865.

2. Service Description and Support Workflow

The service allows the university community and the general public to contact academic, administrative, or service-related support teams of the University through multiple channels integrated into our internal management platform, “OcielWoot!”.

The channels covered by this policy are:

• Integration with Meta Platforms: through the “¡Hola Ociel!” application, which connects Facebook Messenger, Instagram Messaging, and WhatsApp with the UAN's institutional infrastructure.
• Web Widget: chat available at https://ociel.uan.mx/.
• PiiDA Platform: institutional platform for UAN students and faculty.
• Email: communications sent to hola@uan.edu.mx, ociel@uan.edu.mx, holaociel@uan.edu.mx, soportepiida@uan.edu.mx, admision@uan.edu.mx.

The purpose of this integration is to centralize, track, and resolve requests related to academic, administrative, and general services of the UAN.

The support workflow operates under a hybrid escalation model that combines intelligent automation with specialized human intervention, which proceeds as follows:

1. Initial Interaction and Automated Processing: Upon starting a conversation (which is logged and tracked from OcielWoot! by agents), the user will first interact with OcielAi, an artificial intelligence agent programmed to understand and respond to queries based on information contained in the OcielVerse, the validated and updated institutional knowledge base.
2. Escalation Criteria: If the OcielAi agent cannot satisfactorily resolve the request, if the nature of the query exceeds its response capabilities, or if the user requests human intervention, the system will trigger the escalation process.
3. Transfer to Human Agents: The conversation, along with its complete history and associated data, will be seamlessly transferred to a human Agente Ociel Prime, who will, if necessary, assign the conversation to an Agente Ociel from the competent area to manage the case for proper attention and resolution.

3. Personal Data We Collect

Depending on the contact channel, UAN may collect the following categories of personal data:

a) Data collected automatically from Meta APIs and Email

• Username and/or full name associated with your profile.
• Unique user identifier (platform ID).
• Profile picture (if public).

b) Data provided directly by the user

• Full name.
• Email address.
• Phone number (optional).
• Student ID, major, academic status, and school-related data, among others, when necessary to address your request (optional).
• Content of messages, files, documents, or images voluntarily shared.

c) Technical and interaction-derived data

• IP address, browser type, operating system, device type, among other technical data used for the connection.
• User-Agent, session metadata, and telemetry metrics for diagnostic, security, and service improvement purposes.
• Conversation history to track previous requests.
• Event logs generated by the monitoring, telemetry, and evaluation infrastructure (umami, signoz, grafana, arize-phoenix).

d) Data collected by third-party platforms

The user is informed that when using the platform through channels operated by third parties such as Meta (Facebook, Instagram, WhatsApp), Telegram, or email providers (e.g., Google), these companies collect and process personal data according to their own privacy policies. UAN has no control over the data processing practices of such third parties and limits its actions to the terms and conditions of their respective APIs for service provision.

We do not collect sensitive personal data through this platform, understood as data that could affect the most intimate sphere of the data subject. Users are requested not to share this type of information through the chat channels.

4. Purposes of Data Processing

The personal data collected will be used exclusively for the following purposes, with the legal basis to do so within the framework of our attributions as a public educational institution:

Primary Purposes (Necessary for service provision)

The processing of your data for these purposes is based on Article 22, sections II and V of the LGPDPPSO, as it is necessary for the exercise of the powers and attributions conferred by law to the Universidad Autónoma de Nayarit.

1. To identify and register communication with students, applicants, alumni, faculty, staff, and the general public through the integrated digital channels.
2. To process the user's initial query through the artificial intelligence agent (OcielAi) to provide an immediate response. To achieve this, the content of the query may be processed by large language models (LLMs) hosted on both UAN's infrastructure and the services of specialized technology providers, such as OpenAI, who acts as a data processor under the terms established by law.
3. To attend, manage, and respond to academic or administrative requests and queries that are escalated to human agents.
4. To channel and assign requests to the competent area or department within UAN.
5. To consult academic and administrative information in internal institutional systems, when strictly necessary, to provide an accurate and personalized response.
6. To provide follow-up, traceability, and closure for cases handled on the platform.

Secondary Purposes (Not essential for the service, but allow for its improvement)

You may express your refusal for the processing of your data for these purposes through the contact channels of the Transparency Unit.

• To generate disassociated (anonymous) institutional statistics and indicators for the continuous evaluation and improvement of the service.
• To use conversation data, after an irreversible process of disassociation and aggregation that prevents the identification of data subjects, for research, development, and training of UAN's proprietary artificial intelligence models, with the aim of improving the accuracy, efficiency, and quality of the “OcielWoot!” platform.

UAN does not use personal data for commercial, advertising, profiling, or marketing purposes, nor does it share data with third parties for purposes other than those described herein.

5. Data Transfer, Disclosure, and Retention

a) Data Disclosure

• Internal Disclosure: For the proper handling of requests, user information, including conversation history, may be shared with and accessed by authorized Agentes Ociel from different UAN departments whose intervention is necessary to resolve the query.
• Relationship with Third Parties (Communication and Processing Channels): User communication occurs through technology providers like Meta, Telegram, or Google, who act as controllers of their own platforms. UAN's legal relationship with this data is that of a Data Controller from the moment the personal data enters the University's infrastructure via the corresponding APIs.
• Additionally, for the generation of responses by the OcielAi agent, UAN may use the services of specialized technology providers as a data processor (technically classified as a Data Remission in LGPDPPSO terminology). These providers include, but are not limited to, OpenAI and Google LLC (through its Gemini API and Google AI Studio), which may be used as backup and for load balancing. For this processing, consent and legal justification (Art. 75 LGPDPPSO) are sought to strengthen user guarantees.
  • Data Transfer to AI Providers: For OcielAi to understand and respond to your request, the textual content of your query will be sent to our technology providers' APIs. This transfer is conducted under strict security measures (encryption in transit) and is governed by data processing agreements that obligate providers to use the information solely for real-time processing and generating the requested response, explicitly prohibiting the storage or use of such data for training their public AI models or for other purposes not authorized by UAN.
  • International Data Transfer: Since our AI providers' servers are located outside of Mexico, this communication constitutes an international data transfer, which is performed in compliance with Article 75 of the LGPDPPSO, as it is necessary for the maintenance and fulfillment of the service relationship between the user and UAN. By using the service, you expressly consent to this transfer. It is important for the user to understand that by consenting to this transfer, their personal data becomes subject to the legislation of the countries where the providers' servers are located. This could mean that the information is subject to a different data protection framework than Mexico's and, potentially, to access requests by government authorities in those jurisdictions, according to their local laws.
• UAN only extracts and processes the data described in section 3, subsection a), of this policy to fulfill its primary purposes. UAN is not responsible for the infrastructure or privacy practices of these third parties.
  Regardless of the policies of the communication channel providers, once the information enters the University's infrastructure, its processing is strictly governed by the principles of Privacy, Transparency, and Confidentiality. UAN adheres to the applicable regulatory framework, ensuring that the internal management of the data complies with the highest standards of security and protection, even if the initial communication medium is operated by a third party.

b) Data Retention

• Once the interaction with the user concludes, the complete record of the conversation and associated data is hosted and retained entirely on UAN-owned servers, physically located in the University's data center (SITE) on the Tepic “Amado Nervo” campus. This includes the "OcielWoot!" (conversation management), "OcielVerse" (knowledge base), and "OcielAi" (artificial intelligence agent) platforms, as well as monitoring and telemetry tools, ensuring that the permanent storage of data does not leave the infrastructure controlled by the University.
• While there is an international data transfer for momentary processing purposes by OpenAI, as described in the previous subsection, the long-term retention and archiving of personal information are carried out exclusively on servers located within national territory.
• Conversation records are kept on the active "OcielWoot!" platform for a maximum period of 18 months to allow for case follow-up and consultation of previous interactions. After this period, the data is subject to deletion or irreversible disassociation (according to the Document Disposition Catalog) and archived in offsite security backups under institutional control, which are kept indefinitely for operational continuity and historical or statistical recording purposes, under strict security measures and restricted access.
• Data may be permanently deleted from active systems upon the express request of the data subject exercising their right of cancellation.

6. Data Security

UAN implements reasonable physical, technical, and administrative security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing. These measures are formally described and are mandatory in the University's internal Security Document, ensuring the confidentiality, integrity, and availability of information, and include, among others:

• Encryption in transit using secure protocols (HTTPS/TLS).
• Encryption of sensitive data in databases at rest.
• Restricted access controls based on roles and institutional authentication.
• Security monitoring and internal telemetry for incident detection and response.
• Policies for controlled backup and recovery of information.

7. ARCO Rights (Access, Rectification, Cancellation, and Opposition)

Users can exercise their ARCO rights at any time in accordance with the General Law on the Protection of Personal Data Held by Obligated Parties. Requests should be addressed to the Transparency Unit of the Universidad Autónoma de Nayarit, through:

• Email: transparencia@uan.edu.mx
• Address: Edificio de la Hemeroteca, Ciudad de la Cultura "Amado Nervo" S/N, Tepic, Nayarit, México, C.P. 63000.
• Phone: +52 (311) 211 8865
• Website: https://transparencia.uan.mx/unidad-de-transparencia

8. Changes to the Privacy Policy

UAN may modify or update this Privacy Policy at any time to reflect changes in our practices or applicable legislation. The current versions and their updates will be published at:

👉 https://ociel.uan.mx/hola-ociel/privacy-policy

Any substantial changes will be communicated in a timely manner through institutional channels.

9. Acceptance

By interacting with any of the support channels of the “¡Hola Ociel!” Comprehensive University Assistance Platform, the user acknowledges having read, understood, and accepted the terms of this Privacy Policy. In particular, the user expressly consents to the processing of their data according to the described support workflow, including the initial processing by an artificial intelligence agent and its subsequent transfer to a human agent if necessary for the proper handling of their request.

10. Contact Information

For any questions, clarifications, or to exercise your ARCO rights, please contact:

Transparency Unit of the Universidad Autónoma de Nayarit.
Email: transparencia@uan.edu.mx.

For technical or operational questions about the platform, you may also contact the Dirección General de Sistemas (DGS).
Email: dgs@uan.edu.mx.