Privacy Policy
What we collect when you contact us, why we hold it, who else sees it, and how to get it back or have it deleted.
Last updated:
This policy covers undercodes.net. It explains what happens to your information when you browse the site or send us an enquiry.
Who is responsible
UnderCodes is the controller of the data described here. We are a distributed technology company, with team members and representation in the United States and Colombia, and clients in the United States, Spain and Colombia.
For anything in this document — including any request about your data — write to contactanos@undercodes.net. It reaches a person, not a queue.
What we collect
What you send us. The contact form asks for your name, work email address,
company, the subject you want to talk about, and a description of what you need.
Your role, your phone number, and the project stage or timeline are optional. Along with that, we record the language of the page you
wrote from, the moment you sent it, the address of that page, the site that
referred you if there was one, and the campaign parameters (utm_source,
utm_medium, utm_campaign) when the link you followed carried them.
We also record that you ticked the consent box, and when. That record exists so that we can demonstrate the consent was given — which is itself a legal requirement.
What is collected automatically. Our hosting provider keeps standard server logs — IP address, browser identification, the page requested, the time — for delivery and for protection against abuse.
What we collect only if you allow it. If you accept the consent banner, we use Google Analytics 4 to see which pages are read before someone gets in touch. It records the pages you visit, roughly where you are in the world, and the kind of device and browser you use, against a random identifier that is not your name and that we never connect to an enquiry you send us. Until you accept, none of it runs; if you refuse, none of it ever runs. The Cookie Policy names the two cookies involved and explains how to change your mind.
What we do not collect, whatever you answer. No advertising technology, no remarketing tags, no tracking pixels and no profiling. We build no picture of you as an individual, and nothing on this site tries to recognise you on another one.
Why we use it, and on what basis
- To answer your enquiry, and to follow up on it. Your consent, given when you submit the form, together with our legitimate interest in responding to a business approach. You can withdraw consent at any time.
- To keep proof that consent was given. Our legitimate interest in being able to demonstrate compliance.
- To keep the site available and safe. Our legitimate interest in operating it.
- To understand which pages are useful. Your consent, given through the banner. It is the only basis we rely on for analytics, which is why nothing loads until you give it, and why refusing has no consequence for you.
We do not sell your data. We do not share it for anyone else’s marketing. No decision about you is made automatically.
Who else handles it
We use a small number of providers, each under contract, each acting only on our instructions and none permitted to use your data for its own purposes:
- Cloudflare, Inc. — hosting and delivery of this site.
- Odoo — the CRM where enquiries are recorded and answered.
- Our email provider — for the reply itself.
- Google Ireland Limited — Google Analytics, and only where you have accepted it.
Beyond those, only the people on our team who need to answer you, and all of them under a duty of confidentiality.
We may also disclose information where the law requires it, and will tell you if we are permitted to.
Where it goes
Our providers process data in the European Union and the United States. Where data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or, failing that, on the European Commission’s standard contractual clauses. If you are in Colombia, transfers are made under the conditions set out in Ley 1581 de 2012 and its implementing decrees.
How long we keep it
We keep an enquiry for as long as it takes to answer it and to carry on the conversation it started, and in any case no longer than 24 months after our last exchange, at which point it is deleted or anonymised. The record of your consent lives as long as the enquiry it belongs to. Server logs are kept by our provider for a short retention period and then discarded.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to our processing it, and you can withdraw consent — withdrawing it does not undo what was lawful beforehand.
Write to contactanos@undercodes.net. We do not require a particular form of words. We will reply within one month; if a request is complex we will tell you so, and why, before that month is up. Requests under Ley 1581 de 2012 are answered within the shorter periods that law sets for consultas and reclamos.
If you think we have got this wrong, you can complain to a supervisory authority: in the European Economic Area or the United Kingdom, the one for the country you live in; in Colombia, the Superintendencia de Industria y Comercio. We would rather you told us first, but that is your right and not a step you owe us.
Children
This site is aimed at businesses. It is not directed at children and we do not knowingly collect their data.
Changes to this policy
If we change it, we change the date at the top of this page. Where a change materially affects how we use data you have already sent us, we will contact you about it rather than leave it to a date stamp.