Personal data processing policy

Data controller

The controller is the company identified at the end of this page under the trade name Netzi. For anything related to your data, write to [email protected].

What data we process and where it comes from

Data you give us: when you fill in the contact form (name, email address, phone number if you choose to provide it, and the content of your message) or when you write to us directly by email or WhatsApp.

Technical data: when you visit the site, the server and the content delivery network record your IP address, browser and requested pages in order to serve the site, protect it from abuse and detect failures. The form is protected by Cloudflare Turnstile, which analyzes technical signals from your browser to tell people apart from robots.

Usage statistics without cookies: with Umami, installed on our own servers, we count pages viewed, the referring page, browser, operating system, device type, approximate country, language and actions such as pressing a button, opening a product or submitting the form (never its content). Umami does not use cookies or store your IP address: it uses it to work out the country and an encrypted identifier that changes every day, so we cannot know who you are or follow you from one day to the next.

Usage data through Google Analytics, only if you accept analytics cookies: pages viewed, length of visit, device type and approximate country.

We do not request or process sensitive data (health, origin, beliefs, biometrics, etc.) or data of persons under 18. We ask you not to include sensitive data or third-party data in your message.

What we use it for and on what basis

To reply to your message, assess your project and prepare a proposal. Basis: your prior, express and informed authorization (Colombia) and the pre-contractual steps you request (Article 6(1)(b) of the GDPR; Article 7(V) of the LGPD).

To keep the site secure and prevent abuse of the form: Turnstile verification, a limit on submissions per IP address and a honeypot field against robots. Basis: our legitimate interest in protecting the service (Article 6(1)(f) of the GDPR; Article 7(IX) of the LGPD).

To measure use of the site so we know what is read and can improve it. With Umami, without cookies or data that identify you. Basis: our legitimate interest (Article 6(1)(f) of the GDPR; Article 7(IX) of the LGPD); you can avoid it by blocking the script in your browser. With Google Analytics. Basis: your consent, which you give or refuse in the cookie notice and can withdraw at any time.

To keep proof of your authorization and comply with legal obligations. Basis: legal obligation and legitimate interest in being able to demonstrate it.

Who else sees your data

We do not sell personal data or share it for marketing purposes. It is processed only on our behalf and under contract by these providers:

Hetzner Online GmbH (Germany): servers where the site runs, where your message is processed and where usage statistics are stored.

Cloudflare, Inc. (United States): content delivery network, protection against attacks and the Turnstile service on the form. Certified under the EU-U.S. Data Privacy Framework.

Bird (MessageBird USA, Inc., which operates SparkPost; United States): sending of the email that delivers your message to us. Certified under the EU-U.S. Data Privacy Framework.

Google LLC (United States): the mailbox where we receive messages and, only with your consent, Google Analytics. Certified under the EU-U.S. Data Privacy Framework.

WhatsApp (Meta Platforms): only if you choose to write to us through that channel; its own privacy policy applies.

When any of these providers processes data outside the European Economic Area or Colombia, it does so with the safeguards required by law: adequacy decisions, the Data Privacy Framework or standard contractual clauses. You can ask us for a copy of those safeguards.

How long we keep it

Contact messages: up to two years from the last communication, unless a contract is signed; in that case, for the duration of the relationship and the subsequent statutory retention periods.

Record of submissions per IP address to limit abuse: ten minutes, in server memory.

Proof of authorization for processing: together with the message it relates to.

Umami statistics: aggregated only and without data that identify you; kept for as long as they are useful.

Google Analytics data: data associated with a visitor is deleted after two months; aggregated reports, which do not identify anyone, are kept for as long as they are useful.

The contact database is kept for as long as the purpose described exists; when it is no longer necessary, the data is deleted or anonymized.

Your rights

In Colombia (Law 1581 of 2012): to know, update and rectify your data; to request proof of the authorization you gave us; to be informed about the use we have made of it; to revoke the authorization and request deletion when there is no legal or contractual duty to keep it; and to file complaints with the Superintendence of Industry and Commerce (www.sic.gov.co). We answer inquiries within a maximum of ten business days and claims within a maximum of fifteen business days, extendable as provided by law.

In the European Economic Area (GDPR): access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent at any time, without affecting processing carried out beforehand. We reply within one month. You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the authority in your country.

In Brazil (LGPD): confirmation of the existence of processing, access, correction, anonymization, blocking or deletion, portability, information about who we share the data with, and revocation of consent. You can lodge a complaint with the National Data Protection Authority (ANPD).

To exercise any of these rights, write to [email protected] stating what you are requesting and from which email address you contacted us, so that we can identify you. We reply through the same channel.

How we protect it

The site is served exclusively over HTTPS, messages travel encrypted to our mailbox, access to the systems is limited to the people who need it, and the servers are located in data centers in the European Union. No measure is infallible; if we detect an incident affecting your data, we will notify you as required by law.

Minors

The site is aimed at companies and professionals. We do not knowingly process data of persons under 18; if you believe a minor has sent us data, write to us and we will delete it.

Changes to this policy

If we change this policy, we will publish the new version on this same page with its version number and effective date. Changes do not apply retroactively to what we had already informed you of.