Privacy Statement

1. Data Controller

2. Data Collection

We collect and process the following categories of personal data:

• Contact information (name, email address, phone number)
• Organization and professional details
• Information provided in consultation and inquiry forms
• Communication history related to our services
• Website usage data through cookies and analytics

3. Purpose of Data Processing

Your personal data is processed exclusively for the following purposes:

• Responding to consultation inquiries and service requests
• Providing digital transformation and consulting services
• Business communication and relationship management
• Improving our services and website experience
• Compliance with legal and regulatory obligations

4. Legal Basis

We process your personal data based on the following legal grounds:

• Consent: When you explicitly agree to data processing (Article 6(1)(a) GDPR)
• Contract: For fulfillment of contractual obligations (Article 6(1)(b) GDPR)
• Legitimate Interests: For business operations and service improvement (Article 6(1)(f) GDPR)
• Legal Obligations: To comply with applicable laws (Article 6(1)(c) GDPR)

5. Data Retention

We retain personal data only as long as necessary for the purposes stated above or as required by law:

• Business inquiry data: Typically retained for 3 years
• Contract-related data: Duration of business relationship plus statutory retention periods
• Marketing communications: Until consent is withdrawn
• Legal compliance data: As required by applicable regulations

6. Data Security

We implement comprehensive technical and organizational measures to protect your personal data:

• Encrypted data transmission using SSL/TLS protocols
• Secure data storage with access controls
• Regular security assessments and updates
• Staff training on data protection best practices
• Incident response procedures for data breaches

7. Your Rights

Under applicable data protection laws, you have the following rights:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit processing of your data
• Portability: Receive your data in a structured format
• Objection: Object to certain types of processing
• Withdraw Consent: Revoke previously given consent at any time

To exercise these rights, please contact us using the information provided in Section 1.

8. Third-Party Services

We use carefully selected third-party services to operate our website and provide our services:

Analytics Services

• Google Analytics: Website traffic analysis (Google LLC, USA)

Communication Services

• FormSubmit: Secure contact form processing

These services may process data outside the European Economic Area. We ensure appropriate safeguards are in place.

9. International Data Transfers

As we operate from the United States, your data may be transferred to and processed in the United States. We ensure appropriate safeguards for international data transfers:

• Standard Contractual Clauses approved by the European Commission
• Adequate security measures for data protection
• Compliance with applicable international data transfer regulations

10. Cookie Policy

Our website uses cookies to enhance functionality and analyze usage:

Types of Cookies We Use

• Essential Cookies: Required for website operation (cannot be disabled)
• Analytics Cookies: Help us understand website usage patterns
• Functional Cookies: Remember your preferences and settings

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

11. Contact for Privacy Matters

For questions, concerns, or requests regarding this Privacy Statement or our data processing practices:

12. Updates to This Statement

We may update this Privacy Statement to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised "Last Updated" date. For significant changes, we may provide additional notice through our website or direct communication.

13. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, this is the supervisory authority in your member state. We encourage you to contact us first to address any concerns.

14. GDPR Rights for European Residents

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have enhanced rights under the General Data Protection Regulation (GDPR):

• Right to Access: Obtain confirmation whether we process your data and receive a copy
• Right to Rectification: Correct inaccurate or complete incomplete personal data
• Right to Erasure: Request deletion under specific circumstances
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Rights Related to Automated Decision-Making: Not be subject to solely automated decisions

We will respond to your request within one month, extendable by two months for complex requests. There is no fee unless requests are manifestly unfounded or excessive.

For GDPR-related inquiries, contact our Data Protection Officer at dpo@contraco.com

15. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell personal data)
• Right to non-discrimination for exercising privacy rights

To exercise these rights, California residents may contact us using the information in Section 11.