Privacypolicy.

1. Data controller

Tecnologías de la Información y Talentos, S.A. de C.V. ("ITProject", "we") is the controller of the personal data collected through this website (itproject41.com).

Personal Data Protection Officer: Maria Cerna, [email protected].

Address: CC La Gran Vía, Antiguo Cuscatlán, La Libertad, El Salvador.

This policy applies to the ITProject corporate website and its forms. Our products (FacturaYa, EcoTickets and Kelova) have their own legal documentation on their respective sites.

2. Data we collect

We only collect the data you give us or that is generated while you browse:

• Contact form: name, email, phone and company (optional), service of interest and your message.
• Proposal request: name, email, phone, company, service of interest, project description and, if you provide them, estimated budget and timeline.
• Job application: name, email, phone, LinkedIn profile, position, cover letter and your CV as a PDF.
• Browsing data: IP address, browser and device type, pages visited and similar technical data, through server logs and, when enabled, audience measurement (Google Analytics).

If you message us on WhatsApp or book a call on Calendly, those platforms process your data under their own policies; we only receive what you share in that conversation or booking.

We do not request sensitive data. Please do not include it in your messages or CV.

3. Purpose and legal basis

• Replying to your enquiries and following up on your request → Legal basis: your consent and pre-contractual steps taken at your request.
• Preparing and sending you a proposal, and scheduling the assessment → Legal basis: pre-contractual steps taken at your request.
• Reviewing your application and contacting you during the hiring process → Legal basis: your consent.
• Measuring site usage in aggregate to improve it → Legal basis: legitimate interest.
• Keeping the site secure and preventing abuse → Legal basis: legitimate interest.
• Complying with legal obligations → Legal basis: legal obligation.

The processing of personal data is governed by the Personal Data Protection Law of El Salvador (Legislative Decree No. 144) and other applicable Salvadoran regulations, under the supervision of the State Cybersecurity Agency (ACE).

We do not use your data for automated decision-making or for profiling with legal effects on you.

4. Providers that help us

We share data only with the providers needed to run the site, and only for that purpose:

• Mailgun (USA): delivering form submissions to our team by email, including attached CVs, and sending the calculator report to whoever requests it.
• Google Cloud (USA): website hosting.
• Google Analytics (USA): aggregate audience measurement, when enabled.
• Google Maps (USA): location map on the contact page.
• Contentful (USA/EU): blog content management; it does not receive form data.
• Calendly and WhatsApp (USA): only if you choose to use them to book a call or message us.

We do not sell or rent personal data. We will only share it with authorities when required by law or by a competent order.

5. International transfers

Several of our providers operate in the United States, so your data may be transferred to and processed there. We follow the mechanism required by Salvadoran law: contractual commitments with providers to protect data in accordance with Legislative Decree No. 144. The specific mechanism will be confirmed with the ACE once it publishes its regulation on international transfers.

6. Data retention

• Enquiries and proposal requests: up to 2 years from the last contact.
• Applications and CVs: for the duration of the hiring process and up to 12 months afterwards, so we can consider you for future openings, unless you ask us to delete them sooner.
• If we reach a commercial agreement, contract and billing data are kept for 7 years (Salvadoran tax requirement).
• Technical server logs: 90 days.

We may keep data longer when necessary to comply with legal obligations or to resolve pending disputes.

7. Your rights

Under the Personal Data Protection Law of El Salvador (Legislative Decree No. 144), you have the following rights, known as ARCO-POL:

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data when it is no longer needed or you withdraw your consent.
• Objection: to object to processing in certain cases, for example to receiving commercial communications.
• Portability: to receive your data in a structured format, where applicable.
• Right to be forgotten: to request the removal of certain information published online, where appropriate.
• Restriction: to ask us to restrict processing in certain circumstances.

To exercise them, email the Personal Data Protection Officer at [email protected] with the subject "ARCO-POL rights request", stating the right you wish to exercise and your identification. It is free of charge. We reply within a maximum of 20 business days, which may be extended for justified reasons under applicable regulations.

8. Visitors from the European Economic Area and the United Kingdom (GDPR)

If you contact us or visit the site from the European Economic Area (EEA) or the United Kingdom, Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and, in the United Kingdom, the UK GDPR also apply.

• Legal bases (Art. 6 GDPR): your consent for audience measurement and for reviewing your application; pre-contractual steps taken at your request to reply to enquiries and prepare proposals; our legitimate interest in keeping the site secure; and compliance with legal obligations.
• Your rights: access, rectification, erasure, restriction of processing, portability, objection and not to be subject to automated decision-making. You can withdraw your consent at any time without affecting the lawfulness of prior processing.
• Cookies: we do not set measurement cookies until you accept them in the cookie notice. You can change your choice at any time from "Cookie settings" in the footer.
• Transfers: your data is processed in El Salvador and the United States. For these transfers we rely on the Standard Contractual Clauses approved by the European Commission, included in our providers' data processing agreements, or on other valid mechanisms under the GDPR.
• Response time: we will handle your requests within one month, which may be extended under Art. 12 GDPR.

To exercise your rights, write to [email protected]. You also have the right to lodge a complaint with the data protection supervisory authority of your country of residence, place of work or place of the alleged infringement.

9. Security

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS) across the whole site, access limited to the staff who need the information to handle your request, and credentials managed outside the source code.

No system is 100% secure. If a security breach affects your personal data, we will notify you within a maximum of 72 hours of its detection, in accordance with applicable law.

10. Cookies and local storage

• Technical: we remember your language (NEXT_LOCALE cookie) and, if you choose it, the light or dark theme (browser local storage). They are needed for the site to work as you expect.
• Measurement: when enabled, Google Analytics uses first-party cookies (for example, _ga) to count visits in aggregate. If you visit from Europe, they are only set if you accept them in the cookie notice.
• Third parties: Google Maps and Calendly may set their own cookies when you use them.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; the site will keep working, although it may not remember your language.

11. Minors

This site is intended for businesses and people aged 18 or over. We do not knowingly collect data from minors. If you know a minor has sent us data, write to [email protected] so we can delete it.

12. Changes to this policy

We may update this policy when our services or the regulations change. We will publish the new version on this page with its effective date.

13. Contact and complaints

For any question about this policy: [email protected] or [email protected], with the subject "Privacy — [your question]".

If you believe the processing of your data does not comply with applicable regulations, you may file a complaint with the State Cybersecurity Agency (ACE) of El Salvador.