Privacy Policy

The controller responsible for processing your personal data is:

We have not appointed a data protection officer. For any question about your data, write to the address above.

We process the following data, depending on how you deal with us:

• →Contact form: name, email address, company (optional), service of interest (optional) and message. The form is not saved in the site's database: it reaches us by email, and we send you an automatic confirmation.
• →Call bookings: your name, email and whatever you enter in the Cal.com booking form.
• →Client Portal (clients only): the contact person's email and name, company and tax details, contracts, projects and milestones, invoices, subscription status and the documents we share with you in the portal.
• →Accepting a contract in the portal: we keep the date, your email, the name you type, your IP address and the browser you use, as evidence of acceptance.
• →Payments: handled by Stripe. Your card details go straight to Stripe and never pass through our servers; we receive the payment status, the amount and the transaction identifiers.
• →Usage statistics: page visited, source of the visit, device type and country, through Plausible Analytics. Plausible reads your IP address and browser identifier to compute a daily code that cannot recognise you the next day, and does not store the IP. It uses no cookies.
• →Technical data: your IP address reaches the server on every visit, as on any website, and may appear in its technical logs. In addition, when you send the contact form or request portal access we use your IP to limit the number of submissions; that record deletes itself within hours.
• →Studies and surveys: if you take part in a NeoCompás study, the processing is explained in its own notice: privacy notice for the “Entre Sistemas” study.

We do not ask for special category data (health, racial origin, biometric data, etc.). We make no automated decisions and do no profiling.

We process your data for the following purposes and legal bases (GDPR Art. 6):

Giving us your data is voluntary. Without a contact email we cannot reply to you, and without contract and billing details we cannot provide the service.

• →Contact form messages: 3 years from the last contact, or until you ask for deletion.
• →Bookings (Cal.com): per Cal.com's retention policy, at cal.com/privacy.
• →Client, contract and invoice data: for the duration of the contractual relationship and, afterwards, for the periods required by commercial and tax law.
• →Evidence of contract acceptance: while the contract is in force and for the period in which claims about it may be brought.
• →Usage statistics: Plausible data is aggregated and identifies no one; it is kept as site statistics.
• →IP used to limit submissions: deleted automatically within hours.

To provide the service we use the following providers, which process data on our behalf under their data processing terms:

Stripe also processes part of the payment data as a controller in its own right, under its terms. We do not sell, rent or share personal data with third parties for their own commercial purposes. We would disclose it to authorities only where a law obliges us to.

The site and its database are in Germany. Some providers are based or process data outside the European Economic Area (EEA). These are the safeguards each one states in its terms:

• →Hetzner and Plausible: process data in Germany. No transfers outside the EEA.
• →Supabase: data is hosted in Frankfurt. The company providing the service is outside the EEA and applies the European Commission's Standard Contractual Clauses (GDPR Art. 46.2.c).
• →Resend, Cal.com and Upstash: US companies. Resend and Cal.com process data in the United States; the Upstash database is in Frankfurt. All three state that they adhere to the EU-US Data Privacy Framework (GDPR Art. 45) and apply Standard Contractual Clauses as an additional safeguard.
• →Stripe: may process data in the United States. It states that it adheres to the EU-US Data Privacy Framework and applies Standard Contractual Clauses.
• →Sanity: may process data outside the EEA and applies Standard Contractual Clauses.
• →Zoho: our account is in Zoho's European data centre (zoho.eu). The Zoho group also operates outside the EEA and states that it applies Standard Contractual Clauses between its companies.

You can ask us for a copy of these safeguards by writing to info@neocompas.com.

As a data subject, you have the following rights under Regulation (EU) 2016/679 (GDPR):

• →Access (Art. 15): Obtain confirmation of whether we process your data and a copy of it.
• →Rectification (Art. 16): Correct inaccurate or incomplete data.
• →Erasure / Right to be forgotten (Art. 17): Request deletion of your data when it is no longer necessary or you withdraw consent.
• →Restriction of processing (Art. 18): Request we suspend processing while you contest its accuracy or lawfulness.
• →Portability (Art. 20): Receive your data in a structured, machine-readable format.
• →Objection (Art. 21): Object to processing based on legitimate interest.
• →No automated decision-making (Art. 22): We do not make automated decisions with legal effects about you.
• →Withdraw consent (Art. 7.3): At any time, without affecting the lawfulness of prior processing.

To exercise any of the above rights, send an email to:

info@neocompas.com

Tell us which right you wish to exercise and, if you can, write from the same email address you used with us. We will ask for additional information only if we have reasonable doubts about your identity. It is free of charge. We will reply within one month, which may be extended by two further months if the request is complex; in that case we will tell you within the first month.

If you consider that the processing of your data does not comply with GDPR, you have the right to lodge a complaint with the competent supervisory authority:

• →Spain: Spanish Data Protection Agency (AEPD) — www.aepd.es
• →Colombia: Superintendence of Industry and Commerce (SIC) — www.sic.gov.co

You can write to us first at info@neocompas.com: we will try to resolve it directly.

For data subjects in Colombia, Law 1581 of 2012 and Decree 1377 of 2013 recognise the following additional rights:

• →Know, update, rectify, and delete personal data.
• →Request proof of the consent granted.
• →Be informed about the use made of your data.
• →File complaints with the SIC for violations of the law.
• →Revoke authorisation and/or request deletion of the data.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Measures in place include:

• →Encrypted transmission over HTTPS across the whole site.
• →Client Portal access without passwords, through single-use links sent to your email.
• →Each client can see only their own data and documents; internal access is restricted by role.
• →Submission limits on the contact form and portal access to prevent abuse.

We may update this Privacy Policy to reflect changes in our practices or applicable law. The date of the last update appears at the top of this document. For material changes, we will notify affected users by email or through a notice on the website.