Privacy Policy

1Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and applicable data protection legislation, we inform you:

• Data controller: Elutechfusion LLC (Digital Elevate)
• Activity: Digital marketing agency, web design and branding
• DPO contact email: contacto@digitalelevate.me
• Website: digitalelevate.me

2Data we collect

We may collect the following personal data depending on your interaction with the Website:

• Contact data: name, email address, phone number.
• Browsing data: IP address, browser type, operating system, pages visited and time spent (via analytics cookies, only with prior consent).
• Transaction data: when you make a purchase in our online store, data necessary to process payment through Stripe. We do not store credit card data.
• Communication data: content of messages you send us via the contact form or email.
• Preference data: selected language and cookie preferences.

3Purposes and legal basis for processing

We process your personal data for the following purposes with their corresponding legal bases:

• Managing enquiries and contact: responding to received messages. Legal basis: legitimate interest (Art. 6.1.f GDPR) or pre-contractual measures.
• Provision of contracted services: executing agreed services. Legal basis: contract performance (Art. 6.1.b GDPR).
• Payment processing: managing transactions via Stripe. Legal basis: contract performance (Art. 6.1.b GDPR).
• Sending commercial communications: sending information about our services, updates and promotions. Legal basis: explicit consent (Art. 6.1.a GDPR). You can withdraw this consent at any time.
• Website analysis and improvement: through browsing statistical data. Legal basis: consent (Art. 6.1.a GDPR) via acceptance of analytics cookies.
• Compliance with legal obligations: when required by applicable regulations. Legal basis: legal obligation (Art. 6.1.c GDPR).

4Data retention period

We retain your data for as long as strictly necessary to fulfil the purpose for which it was collected and to address any liabilities arising from such processing:

• Contact and enquiry data: until you request deletion or 3 years of inactivity have elapsed.
• Contractual and billing data: during the contract term plus applicable legal limitation periods (generally 5 years for civil matters).
• Commercial communication data: until you withdraw your consent.
• Browsing data (cookies): depending on cookie type. See our Cookie Policy.

5Your rights

Under the GDPR, you have the right to exercise at any time the following rights over your personal data:

• Access: know what personal data we process about you and obtain a copy.
• Rectification: correct inaccurate, incomplete or outdated data.
• Erasure ("right to be forgotten"): request deletion of your data when, among other circumstances, it is no longer necessary for the purpose for which it was collected.
• Objection: object to the processing of your data in certain circumstances, including processing for commercial communications.
• Restriction of processing: request restriction of processing in certain circumstances.
• Portability: receive your data in a structured, commonly used and machine-readable format.
• Withdrawal of consent: at any time and without retroactive effect, when processing is based on your consent.

To exercise any of these rights, send a request to contacto@digitalelevate.me indicating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of 30 days.

If you believe the processing of your data does not comply with applicable regulations, you have the right to lodge a complaint with your national data protection authority.

6Third-party transfers and recipients

We do not sell or transfer your data to third parties for their own advertising purposes. However, we may share your data with the following recipients for service provision reasons:

• Stripe Inc.: for secure payment processing. Stripe complies with GDPR and adheres to the EU-US Data Privacy Framework. See their policy at stripe.com/privacy.
• Hosting and web hosting providers: for website maintenance, under data processing agreements with appropriate security guarantees.
• Web analytics tools (Google Analytics): only if you have accepted analytics cookies. Google LLC adheres to the EU-US Data Privacy Framework.
• Email marketing tools: only if you have given explicit consent to receive commercial communications.

7Automated decisions and profiling

Elutechfusion LLC does not make automated decisions that produce legal effects on users or significantly affect them, including profiling as defined in Article 22 of the GDPR.

The browsing statistical data we collect via analytics cookies (only with your prior consent) is used in aggregate and anonymised form to improve the website experience, without generating individual profiles or making automated decisions about identified or identifiable natural persons.

Should automated decision-making processes or profiling be implemented in the future, you will be informed in advance in a transparent manner and will be able to exercise your rights in this regard, including the right to obtain human intervention in the process.

8Data security

Elutechfusion LLC applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encrypted connection via HTTPS/SSL protocol on all Website pages.
• Access to data restricted to authorised personnel only and under a duty of confidentiality.
• Regular and automatic backups.
• Regular updates of systems, platforms and security software.
• No storage of payment card data (managed exclusively by Stripe with PCI DSS certification).

In the event of a security breach affecting your personal data, Elutechfusion LLC will notify the relevant supervisory authority and, where applicable, affected individuals within the timeframes established by applicable regulations.