Privacy Policy
What we collect when you contact us, why we hold it, who else sees it, and how to get it back or have it deleted.
Last updated:
This policy covers undercodes.net. It explains what happens to your information when you browse the site or send us an enquiry.
Who is responsible
UnderCodes is the controller of the data described here. We are a distributed technology company, with team members and representation in the United States and Colombia, and clients in the United States, Spain and Colombia.
For anything in this document — including any request about your data — write to [email protected]. It reaches a person, not a queue.
What we collect
What you send us. The contact form asks for your name, work email address,
company, and a description of what you need. Your role and the project stage or
timeline are optional. Along with that, we record the language of the page you
wrote from, the moment you sent it, the address of that page, the site that
referred you if there was one, and the campaign parameters (utm_source,
utm_medium, utm_campaign) when the link you followed carried them.
We also record that you ticked the consent box, and when. That record exists so that we can demonstrate the consent was given — which is itself a legal requirement.
What is collected automatically. Our hosting provider keeps standard server logs — IP address, browser identification, the page requested, the time — for delivery and for protection against abuse.
What we do not collect. There is no analytics on this site, no advertising technology, no tracking pixels and no profiling. We set no cookies of our own; see the Cookie Policy.
Why we use it, and on what basis
- To answer your enquiry, and to follow up on it. Your consent, given when you submit the form, together with our legitimate interest in responding to a business approach. You can withdraw consent at any time.
- To keep proof that consent was given. Our legitimate interest in being able to demonstrate compliance.
- To keep the site available and safe. Our legitimate interest in operating it.
We do not sell your data. We do not share it for anyone else’s marketing. No decision about you is made automatically.
Who else handles it
We use a small number of providers, each under contract, each acting only on our instructions and none permitted to use your data for its own purposes:
- Cloudflare, Inc. — hosting and delivery of this site.
- Odoo — the CRM where enquiries are recorded and answered.
- Our email provider — for the reply itself.
Beyond those, only the people on our team who need to answer you, and all of them under a duty of confidentiality.
We may also disclose information where the law requires it, and will tell you if we are permitted to.
Where it goes
Our providers process data in the European Union and the United States. Where data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or, failing that, on the European Commission’s standard contractual clauses. If you are in Colombia, transfers are made under the conditions set out in Ley 1581 de 2012 and its implementing decrees.
How long we keep it
We keep an enquiry for as long as it takes to answer it and to carry on the conversation it started, and in any case no longer than 24 months after our last exchange, at which point it is deleted or anonymised. The record of your consent lives as long as the enquiry it belongs to. Server logs are kept by our provider for a short retention period and then discarded.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to our processing it, and you can withdraw consent — withdrawing it does not undo what was lawful beforehand.
Write to [email protected]. We do not require a particular form of words. We will reply within one month; if a request is complex we will tell you so, and why, before that month is up. Requests under Ley 1581 de 2012 are answered within the shorter periods that law sets for consultas and reclamos.
If you think we have got this wrong, you can complain to a supervisory authority: in the European Economic Area or the United Kingdom, the one for the country you live in; in Colombia, the Superintendencia de Industria y Comercio. We would rather you told us first, but that is your right and not a step you owe us.
Children
This site is aimed at businesses. It is not directed at children and we do not knowingly collect their data.
Changes to this policy
If we change it, we change the date at the top of this page. Where a change materially affects how we use data you have already sent us, we will contact you about it rather than leave it to a date stamp.