Privacy policy
1. Data controller
The controller of the personal data collected through this website is Ralph van Hattem, acting in his personal capacity as a natural person and not on behalf of any registered legal entity at the date stated above.
Contact for all data protection matters: hello@datumapps.com
The controller intends to incorporate a company under the laws of Spain. Should that incorporation take effect, the personal data described in this policy will be transferred to that entity, which will assume the role of controller. Data subjects will be informed of any such transfer by email to the address they provided, in advance of the transfer taking effect, and will retain at all times the right to object and to request erasure as set out in Section 7.
2. Scope
This policy governs the processing of personal data collected through this website and through the email subscription form embedded in it. It is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR") and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD").
3. Categories of personal data processed
The controller processes the following categories of personal data:
- (a) Email address, provided voluntarily by the data subject through the subscription form;
- (b) Technical data generated automatically when the data subject visits the website, namely IP address, browser type, device type, operating system, referring source and campaign parameters, pages viewed and the submission of the subscription form. This data is used only to produce aggregate visit statistics as set out in Section 6; the IP address is not stored, and no individual visitor is identified.
No special categories of personal data within the meaning of Article 9 GDPR are collected, and the controller does not request them. Data subjects are asked not to submit any information beyond the email address requested by the form.
4. Purposes of processing
Personal data is processed for the following purposes only:
- (a) To assess the existence and scale of interest in a mobile application that is currently in a pre-development phase and which does not exist as a usable product at the date of this policy;
- (b) To contact the data subject by email with information concerning the development and eventual availability of that application;
- (c) To measure, in aggregate and without identifying any individual, the number of visits to this website, the campaigns through which visitors arrived and the number of subscriptions made.
Personal data is not used for automated decision-making or profiling that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR.
5. Legal basis for processing
The legal basis for the processing described in Section 4(a) and 4(b) is the consent of the data subject pursuant to Article 6(1)(a) GDPR, given by the affirmative act of submitting the subscription form.
The legal basis for the processing described in Section 4(c) is the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR in knowing, in aggregate, how many people visit the website and through which campaigns. That interest does not override the interests or fundamental rights of data subjects, since no cookie is placed, no information is stored on or read from the data subject's device, the IP address is not stored and no individual is identified or tracked across websites.
Consent may be withdrawn at any time in accordance with Section 7, without affecting the lawfulness of processing carried out prior to withdrawal. The data subject may object to the processing described in Section 4(c) at any time in accordance with Section 7.
6. Cookies and tracking technologies
This website sets no cookies of its own and stores no information on, and reads no information from, the data subject's device. Consent within the meaning of Article 22(2) of Spanish Law 34/2002 on Information Society Services and Electronic Commerce ("LSSI") and Article 5(3) of Directive 2002/58/EC is therefore not requested for visiting the website.
When the data subject submits the subscription form, the browser sends the email address directly to Intuit Mailchimp, the processor identified in Section 8, which may set its own cookies on its own domain (list-manage.com), including cookies used to protect the form against automated abuse. These cookies are placed by Mailchimp only as a result of the data subject's own request to subscribe, and are governed by Mailchimp's cookie statement.
Visits are counted with Plausible Analytics, a cookieless statistics service. For each visit, Plausible derives a daily identifier from the IP address and browser type combined with a random value that is replaced every twenty-four (24) hours, so that the same visitor is counted once per day; the IP address itself is discarded and not stored, and the identifier cannot be linked across days or to any individual. Only aggregate statistics are retained: pages viewed, referring sources and campaign parameters, country, device and browser type, and the number of subscription form submissions.
Access to every part of this website and to the subscription form does not depend on this processing.
7. Rights of the data subject
Data subjects may exercise the following rights under Articles 15 to 22 GDPR free of charge:
- (a) Right of access to their personal data;
- (b) Right to rectification of inaccurate or incomplete data;
- (c) Right to erasure ("right to be forgotten");
- (d) Right to restriction of processing;
- (e) Right to data portability;
- (f) Right to object to processing;
- (g) Right to withdraw consent at any time.
Withdrawal of consent and erasure of the email address may be effected immediately and without justification by the data subject, by means of the unsubscribe link included in the footer of every email sent by the controller. Activation of that link removes the email address from the mailing list operated through the processor identified in Section 8, and no further communication will be sent.
All other rights may be exercised by written request to hello@datumapps.com. The controller will respond within one month of receipt of the request, which period may be extended by two further months where necessary by reason of the complexity or number of requests, in which case the data subject will be informed within the first month.
Data subjects who consider that their rights have not been respected may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of their Member State of residence.
8. Processors and recipients
Email addresses are stored and processed on behalf of the controller by Intuit Mailchimp, operated by Intuit Inc. and its affiliates, acting as processor within the meaning of Article 28 GDPR. Processing by Mailchimp is governed by the data processing terms published by Intuit Inc. and incorporated into the controller's account.
Technical data is processed on behalf of the controller by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, acting as processor within the meaning of Article 28 GDPR, on servers located in the European Union, under the data processing agreement incorporated into the controller's account.
Personal data is not sold, rented or otherwise transferred to any other third party, save where disclosure is required by law, by a competent authority or by a judicial order.
9. International transfers
Technical data processed by Plausible Insights OÜ remains within the European Union. Intuit Mailchimp, the processor of email addresses identified in Section 8, may transfer personal data to servers located outside the European Economic Area, including the United States. Such transfers are carried out on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework, and additionally on the basis of Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, together with the supplementary measures implemented by those processors.
10. Retention period
Email addresses are retained until the data subject withdraws consent or requests erasure, and in any event for no longer than twenty-four (24) months from the date of collection where no further contact has taken place in that period, after which they are deleted.
Technical data is held only for as long as needed to produce the aggregate statistics described in Section 6, and in any event no longer than twenty-four (24) hours; the aggregate statistics, which contain no personal data, are retained for as long as the controller keeps the Plausible account.
11. Security
The controller applies appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including transmission of this website over an encrypted connection and restriction of access to the processor account to the controller alone.
12. Amendments
This policy may be amended to reflect changes in the processing described above, in the identity of the controller, or in applicable law. The version in force is the version published on this website, identified by the date stated at the head of this document. Material amendments will be notified to data subjects by email.