Privacy policy
1. Data controller
The controller of the personal data collected through this website is Ralph van Hattem, acting in his personal capacity as a natural person and not on behalf of any registered legal entity at the date stated above.
Contact for all data protection matters: hello@datumapps.com
The controller intends to incorporate a company under the laws of Spain. Should that incorporation take effect, the personal data described in this policy will be transferred to that entity, which will assume the role of controller. Data subjects will be informed of any such transfer by email to the address they provided, in advance of the transfer taking effect, and will retain at all times the right to object and to request erasure as set out in Section 7.
2. Scope
This policy governs the processing of personal data collected through this website and through the email subscription form embedded in it. It is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR") and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD").
3. Categories of personal data processed
The controller processes the following categories of personal data:
- (a) Email address, provided voluntarily by the data subject through the subscription form;
- (b) Technical and usage data generated automatically when the data subject interacts with the website, including IP address, browser type and version, device type, operating system, referring source, pages viewed and interaction events. This data is processed only where the data subject has given prior consent to the use of non-essential cookies and similar technologies, as set out in Section 6.
No special categories of personal data within the meaning of Article 9 GDPR are collected, and the controller does not request them. Data subjects are asked not to submit any information beyond the email address requested by the form.
4. Purposes of processing
Personal data is processed for the following purposes only:
- (a) To assess the existence and scale of interest in a mobile application that is currently in a pre-development phase and which does not exist as a usable product at the date of this policy;
- (b) To contact the data subject by email with information concerning the development and eventual availability of that application;
- (c) To measure, in aggregate, the effectiveness of the advertising campaigns through which data subjects arrived at this website.
Personal data is not used for automated decision-making or profiling that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR.
5. Legal basis for processing
The legal basis for the processing described in Section 4(a) and 4(b) is the consent of the data subject pursuant to Article 6(1)(a) GDPR, given by the affirmative act of submitting the subscription form.
The legal basis for the processing described in Section 4(c), and for the placement of non-essential cookies and tracking technologies, is likewise the consent of the data subject pursuant to Article 6(1)(a) GDPR, given through the cookie consent mechanism presented on first access to the website.
Consent may be withdrawn at any time in accordance with Section 7, without affecting the lawfulness of processing carried out prior to withdrawal.
6. Cookies and tracking technologies
This website employs the Meta pixel, a tracking technology operated by Meta Platforms Ireland Limited, for the purpose described in Section 4(c). This technology is not loaded and no associated cookie is placed unless and until the data subject has given prior, specific and unambiguous consent through the consent banner displayed on first access.
Refusal of consent does not restrict access to any part of this website or to the subscription form.
Consent preferences may be revised at any time by clearing the cookies stored by this website in the browser, which will cause the consent banner to be presented again on the next visit.
7. Rights of the data subject
Data subjects may exercise the following rights under Articles 15 to 22 GDPR free of charge:
- (a) Right of access to their personal data;
- (b) Right to rectification of inaccurate or incomplete data;
- (c) Right to erasure ("right to be forgotten");
- (d) Right to restriction of processing;
- (e) Right to data portability;
- (f) Right to object to processing;
- (g) Right to withdraw consent at any time.
Withdrawal of consent and erasure of the email address may be effected immediately and without justification by the data subject, by means of the unsubscribe link included in the footer of every email sent by the controller. Activation of that link removes the email address from the mailing list operated through the processor identified in Section 8, and no further communication will be sent.
All other rights may be exercised by written request to hello@datumapps.com. The controller will respond within one month of receipt of the request, which period may be extended by two further months where necessary by reason of the complexity or number of requests, in which case the data subject will be informed within the first month.
Data subjects who consider that their rights have not been respected may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of their Member State of residence.
8. Processors and recipients
Email addresses are stored and processed on behalf of the controller by Intuit Mailchimp, operated by Intuit Inc. and its affiliates, acting as processor within the meaning of Article 28 GDPR. Processing by Mailchimp is governed by the data processing terms published by Intuit Inc. and incorporated into the controller's account.
Technical and usage data is processed by Meta Platforms Ireland Limited in the circumstances and subject to the consent described in Section 6.
Personal data is not sold, rented or otherwise transferred to any other third party, save where disclosure is required by law, by a competent authority or by a judicial order.
9. International transfers
The processors identified in Section 8 may transfer personal data to servers located outside the European Economic Area, including the United States. Such transfers are carried out on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework, and additionally on the basis of Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, together with the supplementary measures implemented by those processors.
10. Retention period
Email addresses are retained until the data subject withdraws consent or requests erasure, and in any event for no longer than twenty-four (24) months from the date of collection where no further contact has taken place in that period, after which they are deleted.
Technical and usage data is retained for the period applied by the processor identified in Section 6 in accordance with its own retention schedule.
11. Security
The controller applies appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including transmission of this website over an encrypted connection and restriction of access to the processor account to the controller alone.
12. Amendments
This policy may be amended to reflect changes in the processing described above, in the identity of the controller, or in applicable law. The version in force is the version published on this website, identified by the date stated at the head of this document. Material amendments will be notified to data subjects by email.