Privacy Notice

This Privacy Notice explains how Datonum collects, uses and protects the personal data of people who visit datonum.com or get in touch with us. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

1. Who is responsible for your data

The data controller is:

• Rostyslav Bachyk, operating under the commercial name “Datonum”
• Tax identification number (NIE): Z0041311P
• Address: Avenida Fabraquer 3, 17J, El Campello, 03560 Alicante, Spain
• Email: hello@datonum.com

We have not appointed a Data Protection Officer, as our processing does not meet the thresholds in Article 37 GDPR. You can raise any privacy matter with us at the email above.

2. Scope

This Notice covers personal data collected through this website, our inquiry form and email correspondence with us, and our contact with business professionals we reach out to on LinkedIn. It does not cover third-party websites we link to, which have their own privacy policies.

3. What personal data we collect

Information you give us. When you complete the inquiry form or email us, we collect your first name, last name, email address, company name and the content of your message, together with anything else you choose to include. All fields are required; without them we can’t reply to your inquiry.

Information about business contacts we reach out to. If we contact you on LinkedIn about our services, we obtained your name, job title, company and LinkedIn profile URL from your LinkedIn profile or LinkedIn Sales Navigator, together with publicly available information about your company. We use it to contact you about a specific business process and to keep a record of our conversation in our CRM (HubSpot). If you tell us you are not interested, we stop contacting you and keep only a minimal record (your name and company) so that we do not contact you again.

Information collected automatically. When you visit the site, your request passes through Cloudflare, which delivers and protects the site on our behalf (as our processor) and in doing so processes technical data such as your IP address, browser and device type, and the pages you request. Our own web server keeps no access log of your visits; it keeps only a small technical error log, which does not contain your IP address.

Performance measurement. Cloudflare also provides us with Cloudflare Web Analytics: a small script on each page reports how quickly the page loaded, together with the page address, referring website, and browser and device type. It does not use cookies or local storage, and does not create an identifier to recognise you or track you across other websites. Cloudflare processes this data on our behalf (as our processor).

Usage analytics. We use Umami, a privacy-focused, cookieless analytics tool that we host on our own infrastructure, to understand how the site is used. It records aggregated information such as the pages viewed, the referring website, and your approximate location, browser and device type. It does not use cookies, does not store your IP address, and does not create a persistent identifier or track you across other websites.

Cookies and similar technologies, with your consent. If you accept them in our cookie banner, we also use:

• Attribution data — we store in your browser (local storage) the campaign parameters of the link that brought you to our site (for example “LinkedIn post”), the first page you visited and the referring website, so that if you later contact us we know which channel reached you. Kept for up to 90 days.
• Session recording — our self-hosted Umami tool records how you interact with our pages (mouse movement, clicks, scrolling, navigation) so we can review playbacks and improve the site. It uses no cookies, does not store your IP address, and masks everything you type into form fields.
• HubSpot tracking — With your consent, we use HubSpot tracking technologies to record the pages you visit on our website. If you subsequently submit an inquiry, this browsing history may be associated with your contact record in our CRM. We use this information to understand interest in our services and provide relevant context when responding to inquiries and managing business relationships.
• LinkedIn Insight Tag — LinkedIn cookies let LinkedIn report to us, in aggregated form, the professional characteristics of our visitors (such as industry, job function and company size) and, in future, let us show our content on LinkedIn to people who have visited our site.

None of these run unless you opt in, and you can withdraw your choice at any time through “Cookie settings” at the bottom of every page.

We do not intentionally collect special categories of data (such as health, political or religious information). Please do not include sensitive personal data in your message.

4. Why we use it, and our legal basis

• To respond to your inquiry and take steps at your request before any possible engagement — Article 6(1)(b) GDPR, and, where you contact us on behalf of an organisation, our legitimate interest in responding, Article 6(1)(f).
• To manage and follow up on business inquiries and keep records in our CRM — Article 6(1)(f), our legitimate interest in developing and managing business relationships.
• To contact business professionals on LinkedIn about our services and keep a record of those conversations — Article 6(1)(f), our legitimate interest in business-to-business marketing. You can object at any time by replying to our message or emailing hello@datonum.com.
• To operate and secure the website (content delivery and protection by Cloudflare, technical error logs) — Article 6(1)(f), our legitimate interest in the security and proper functioning of the site.
• To measure and improve how the site is used and how fast it loadsthrough privacy-friendly, cookieless analytics (Umami and Cloudflare Web Analytics) — Article 6(1)(f), our legitimate interest in understanding and improving our website.
• To understand which channels bring visitors and inquiries, to link an inquiry to the pages viewed before it, to record sessions, and to measure and target our LinkedIn activity, using the cookies and similar technologies described above — Article 6(1)(a) GDPR, your consent (and Article 22.2 LSSI-CE), which you can withdraw at any time.
• To meet legal, accounting and tax obligations — Article 6(1)(c).
• To send marketing communications, only where you have expressly asked us to — Article 6(1)(a) consent, which you may withdraw at any time.

Where we rely on legitimate interests, we have assessed that they are not overridden by your rights and freedoms. You may object to this processing at any time (see “Your rights”).

5. Who we share it with

We do not sell your personal data. We share it only with:

• HubSpot — our customer relationship management platform; inquiry-form submissions, and, if you accept analytics cookies, your browsing on our site, are stored there on servers in the European Union (acting as our processor).
• LinkedIn — If you consent to marketing technologies, we use the LinkedIn Insight Tag to measure website visits, understand audience characteristics and support advertising activities. LinkedIn processes data collected through the Insight Tag as an independent controller under its Independent Controller Addendum. LinkedIn’s Privacy Policy and Cookie Policy explain its processing practices and the rights available to individuals.
• Hetzner Online GmbH (Germany) — hosting of this website and of our self-hosted analytics (processor).
• Cloudflare — content delivery and security in front of our website, and cookieless performance measurement (Cloudflare Web Analytics) (processor).
• Professional advisers (such as accountants or legal advisers), where necessary and under a duty of confidentiality.
• Public authorities, where we are legally required to disclose.

Where a provider processes personal data on our behalf, it does so under a data processing agreement as required by Article 28 GDPR.

6. International data transfers

• HubSpot stores the data we hold in it in its EU data centre. HubSpot, Inc. (US) may access it remotely for support and security; these transfers are covered by the EU–US Data Privacy Framework, including the UK Extension, and by the European Commission’s Standard Contractual Clauses with the UK Addendum, under HubSpot’s data processing agreement.
• Cloudflare, Inc. (US) is certified under the EU–US Data Privacy Framework, including the UK Extension; its data processing agreement also includes Standard Contractual Clauses.
• LinkedIn processes Insight Tag data as an independent controller, and that data may be transferred to and stored by LinkedIn Corporation in the United States. LinkedIn Corporation is certified under the EU–US Data Privacy Framework, including the UK Extension.
• Hetzner hosts our website and analytics in Germany; this data is not transferred outside the EEA.

You may request a copy of the relevant safeguards using the contact details above.

7. How long we keep it

• Inquiries that do not lead to a business relationship: up to 12 months from our last contact, after which they are deleted or anonymised.
• Data relating to a client relationship: for the duration of the relationship and thereafter for the periods required by law — for example, tax and accounting records are kept for up to 6 years under Spanish commercial and tax law.
• Business contacts we reached out to: up to 12 months after our last contact, unless a business relationship starts; a minimal do-not-contact record is kept for as long as needed to respect your objection.
• Server logs: we keep no access logs of visits. Technical error logs, which contain no visitor IP addresses, are limited to 2 MB and overwritten automatically.
• Usage analytics: kept for up to 24 months.
• Performance measurement (Cloudflare Web Analytics): held by Cloudflare in our account for its standard Web Analytics retention period; we do not export it.
• Session recordings: kept for up to 30 days.
• Attribution data in your browser: up to 90 days.
• Your cookie choice: 12 months.
• HubSpot and LinkedIn cookies: see the table in section 10.

We keep personal data no longer than necessary for the purposes described above.

8. Your rights

You have the right to request access to your personal data, and its rectification or erasure; to restrict or object to its processing; to data portability; and not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not carry out such decision-making). Where processing is based on your consent, you may withdraw it at any time, without affecting processing carried out beforehand.

To exercise your rights, email hello@datonum.com. We may need to confirm your identity. We will respond within one month (extendable by two further months for complex requests), and doing so is free of charge.

If you consider that we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. We would appreciate the chance to resolve your concern first.

9. Security

We apply appropriate technical and organisational measures — including encryption in transit, access controls and the use of reputable providers — to protect personal data against unauthorised access, loss or alteration. No transmission over the internet can be guaranteed to be completely secure.

10. Cookies and similar technologies

Our usage analytics (Umami) and performance measurement (Cloudflare Web Analytics) are cookieless and run without any storage on your device; session recording runs only if you accept analytics. Everything else listed below is used only after you agree to it in our cookie banner. You can change your choice at any time through “Cookie settings” at the bottom of every page, or delete cookies in your browser settings.

LinkedIn may set additional cookies, particularly for visitors signed in to LinkedIn; see LinkedIn’s Cookie Policy.

11. Children

This website and our services are directed at businesses and professionals, not at children. We do not knowingly collect personal data from anyone under 14, the age of digital consent in Spain.

12. Changes to this Notice

We may update this Notice from time to time. The version in force, with its date, is always shown on this page, and we will highlight material changes where appropriate.