Privacy Policy

This page is a translation, for informational purposes, of our Spanish-language Política de Privacidad. In case of any discrepancy between this translation and the original Spanish text, the Spanish version governs.

1. Data controller

INDEFESSO S.A.S. (trading as Ierònne), a company domiciled in Bogotá D.C., Colombia, with tax ID (NIT) 901.907.597-7, is the controller responsible for the personal data collected through this website (the "Site").

Address: Bogotá D.C., Colombia. Phone: +57 322 904 5423. Area responsible for handling inquiries, requests, and complaints about this policy: Data Subject Support, via contacto@ieronne.com.

2. Applicable legal framework

As a controller domiciled in Colombia, this policy is primarily governed by Law 1581 of 2012, Decree 1377 of 2013, and any regulations that amend or complement them (the habeas data regime).

Since the Site receives visitors from other regions, additionally:

• For visitors located in the European Union, the European Economic Area, the United Kingdom, and Switzerland, the principles of the General Data Protection Regulation (GDPR) and local electronic communications rules (ePrivacy) apply regarding the use of cookies, detailed in section 8 and in our Cookie Policy.
• For visitors located in the United States, section 9 describes the rights applicable under state privacy laws, where applicable.
• For visitors located in Canada, section 10 describes the principles applicable under the Personal Information Protection and Electronic Documents Act (PIPEDA).
• For visitors located in other Latin American countries, we apply as internal practice the same principles of transparency, minimization, and consent described in this policy, without prejudice to that country's own data protection regime (for example, the LGPD in Brazil or the LFPDPPP in Mexico), which prevails whenever it applies mandatorily.

3. Data we collect

3.1. Data you provide directly

Through the Site's contact form we collect: name, email, company (optional), phone (optional), service of interest (optional), estimated budget (optional), and the message you write.

We also automatically capture the IP address from which the form is sent. This IP is used exclusively for security purposes (limiting repeated submissions and detecting spam patterns) and is not used for analytics or commercial profiling. The legal basis for this capture is our legitimate interest in protecting the Site's operation, not your consent.

The form also includes a hidden anti-bot control field ("honeypot"): if that field arrives filled in, the request is automatically discarded and not stored, as it's treated as an automated, non-human submission.

Legitimate contact data is stored in a database (Postgres, hosted on Railway's infrastructure) and triggers an automatic transactional email notification to our team, via Resend. Along with this data we also record the date, time, and version of this policy that you accepted by checking the authorization box on the form, as proof of that authorization (see section 9.1).

Besides the form, you can contact us directly on WhatsApp (a featured channel on the Site). Messages you send us through that channel are handled via WhatsApp Business (Meta)'s infrastructure and are additionally governed by WhatsApp's own privacy policy; Meta acts here as a data processor (see section 6).

3.2. Newsletter

If you voluntarily subscribe to our Insights newsletter, we collect only your email address (along with the language and page you subscribed from), to send you notices about new content published on the Site. The legal basis is your authorization, granted by completing and submitting the subscription form. We retain this data while your subscription remains active; it is stored on the same Railway Postgres infrastructure described in section 3.1. You may unsubscribe at any time by writing to contacto@ieronne.com.

3.3. Technical and browsing data

As you browse the Site, with your consent (see section 8) we may automatically collect: IP address, browser type and version, pages visited, time spent, traffic source, and interaction events, through Google Analytics 4 and Google Tag Manager.

We also use Vercel Speed Insights/Analytics to measure the Site's technical performance (load speed, rendering errors), in aggregate and without cookies. This tool does not require your prior consent.

We also use Microsoft Clarity as a heatmap and session-recording tool, which records how you interact with the Site's pages (cursor movement, clicks, scrolling) to improve user experience. This tool uses its own cookies and requires your prior consent under the same conditions described in section 8. Clarity is configured in strict masking mode: all text on the Site, including what you type in the contact form, is automatically masked and never sent to Clarity's servers as legible text.

3.4. Technical error logging

If an error occurs during your visit, the Site automatically logs purely technical information about the error (error message, error identifier, the path or page where it occurred, and the error's technical trace) in an internal database, solely to diagnose and fix Site issues. This log never captures your IP address, email, or any other data that could identify you, not even if the error occurs while you're filling out the contact form.

4. Purpose of processing

We use your personal data to:

• respond to your contact or quote request;
• evaluate and, where applicable, commercially manage your service request;
• maintain communication related to an ongoing project, if you become a client;
• measure and improve the Site's technical and content performance (analytics, with your consent when required);
• diagnose and fix technical issues on the Site;
• comply with legal, accounting, or tax obligations applicable to INDEFESSO S.A.S.

We do not use your data for purposes other than those described here, and we do not sell it to third parties.

5. Legal basis / authorization

For visitors in Colombia, processing of the data you provide on the contact form is based on the data subject's prior, express, and informed authorization (art. 4, literal a, Law 1581 of 2012), granted by checking the acceptance box for this policy. The use of analytics and advertising cookies, by contrast, operates by default from your first visit to the Site; you may reject them or withdraw your authorization at any time from the banner or the cookie preferences panel, an authorization-by-unequivocal-conduct model provided for under art. 7 of Decree 1377 of 2013.

For visitors in the EU/EEA/UK/Switzerland, the applicable legal bases are: (i) consent (art. 6.1.a GDPR) for the use of non-essential analytics and advertising cookies (including Meta Pixel); and (ii) performance of pre-contractual measures or legitimate interest (art. 6.1.b/f GDPR) to process the data you provide yourself when requesting a quote.

For visitors in Brazil, the applicable legal basis is consent (art. 7, item I, Law 13.709/2018 — LGPD), both for processing the data you provide on the contact form and for the use of analytics and advertising cookies, which is requested through the Site's banner before being activated.

6. Who we share data with (data processors)

Your data may be processed by the following providers, acting as data processors under INDEFESSO S.A.S.'s instructions and solely for the purposes described here:

We share limited conversion signals (that you completed the contact form or wrote to us on WhatsApp) with Meta and Google, exclusively to measure the performance of our own ad campaigns and only with your consent. We do not sell your data or share it with third parties other than the processors listed in this section, nor for purposes other than those described here.

7. International data transfer

The contact-form and error-log database is hosted on Railway's infrastructure, on a server located in Amsterdam, the Netherlands (European Union). For you, as a data subject domiciled in Colombia, this means an international transfer of your personal data to the European Union.

The European Union has a data protection regime (GDPR) recognized as adequate under the standards of Law 1581 of 2012 (art. 26), so this transfer does not require any authorization beyond what's described in section 5.

Some of the other providers mentioned in section 6 (Google, Meta, Microsoft, Vercel, Resend) may also process information in the United States or other countries. In those cases, INDEFESSO S.A.S. takes reasonable measures to ensure such processing has adequate levels of protection, including reviewing those providers' privacy policies and certifications.

8. Cookies and tracking technologies

The detailed use of cookies, their classification, and the consent mechanism (including the differentiated behavior for visitors from the European Union, the European Economic Area, the United Kingdom, and Switzerland) is described in our Cookie Policy, which forms an integral part of this Privacy Policy.

9. Data subject rights

9.1. Habeas data rights (Colombia, Law 1581 of 2012)

As a data subject, you have the right to:

• Know, update, and correct your personal data;
• Request proof of the authorization granted (we keep the date, time, and version of this policy you accepted, as described in section 3.1);
• Be informed about how your data is used;
• File complaints with the Superintendencia de Industria y Comercio (SIC) for violations of Law 1581 of 2012;
• Revoke authorization and/or request deletion of your data, when no legal or contractual duty prevents it;
• Access your processed personal data free of charge.

To exercise these rights, write to contacto@ieronne.com indicating which right you want to exercise and enough information to identify you.

Your inquiries will be handled within a maximum term of ten (10) business days from the date of receipt, extendable by five (5) additional business days when it's not possible to handle it within that term, informing you of the reason for the delay before the initial term expires (art. 14, Law 1581 of 2012). Your complaints will be handled within a maximum term of fifteen (15) business days from the day after receipt, extendable by eight (8) additional business days when necessary (art. 15, Law 1581 of 2012).

9.2. Additional rights for visitors in the EU/EEA/UK/Switzerland (GDPR)

In addition to the above, you have the right to: the portability of your data, restriction of processing, and the right to object to processing based on legitimate interest. You also have the right to file a complaint with the data protection authority in your country of residence.

10. Visitors in the United States and Canada

United States: INDEFESSO S.A.S. currently does not meet the revenue or data-volume thresholds that trigger obligations under the CCPA/CPRA in California or equivalent state laws. Regardless, as a good-faith practice we respect the Global Privacy Control (GPC) signal whenever it's technically detectable, treating it as a request to opt out of non-essential analytics.

Canada: in line with PIPEDA principles, we seek your meaningful consent before collecting data for purposes beyond what a Site visitor could reasonably expect, and you may request access to or correction of your information in the same way described in section 9.1.

11. Data retention

Contact-form data is retained for a maximum of 5 years from the last contact, unless a legal, accounting, or tax obligation requires a longer period, or a business relationship is formalized, in which case it's retained for as long as that regulation requires. Technical error logs are retained for a limited period, solely for diagnostic purposes.

12. Minors

The Site is not directed at minors and we do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data without the proper authorization of their parents or legal guardians, please contact us so we can delete it.

13. Information security

We adopt reasonable technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, alteration, or disclosure.

14. Changes to this policy

We may update this policy to reflect operational, technical, or regulatory changes. The date of the last update is shown at the top of this document.

15. Contact

For inquiries, complaints, or to exercise your rights: contacto@ieronne.com.

This document describes data processing as the Site technically operates at the time of publication (Google Consent Mode v2, form backend on Railway Postgres, hosting on Vercel). It should not be copied or reused if the technical infrastructure described here changes without this text being updated accordingly.