Privacy policies

1. Controller and scope

Ideasweb, a brand directed by Marcelo Sosa with public address in Pando, Canelones, Uruguay, is controller of personal data collected to manage its business relationships, website and services. Contact is available through the contact form, Client Area or published email addresses.

This Policy covers visitors, prospects, clients, users, suppliers and contacts. Where Ideasweb processes data within a solution on a client instructions, that client is controller and Ideasweb is processor.

2. Data collected

• Identity and contact details.
• Contract, billing, payment and communication data.
• Account, access, support and preference data.
• Technical data such as IP, browser, device, cookies, visits and security logs.
• Content, files, forms, databases and settings supplied or hosted for service delivery.
• Data from authorised integrations and necessary third parties.

Sensitive data should not be submitted unless necessary, legally supported and subject to specific safeguards.

3. Purposes

We process data to answer enquiries; prepare proposals; verify identity; contract, activate, operate, bill and collect services; provide support; administer infrastructure; personalise the experience; prevent abuse; protect systems; meet legal obligations; defend rights; improve services; and send permitted Ideasweb marketing. Promotional messages can be declined, while necessary operational and contractual notices may continue.

4. Basis for processing

We process personal data with the data subject's consent where consent is required, to manage enquiries and contractual relationships, comply with legal obligations, and in other cases authorised by or exempted under applicable law.

Where we rely on an exception to consent or a legitimate interest recognised by law, we assess its necessity, its connection with the stated purpose and its impact on individuals' rights.

5. Cookies

We may use necessary cookies for sessions, security, language and operation, and measurement or advertising tools. Consent is requested for non-essential technologies where required. Browser controls may be used, though blocking cookies may affect features.

6. Recipients

We do not sell personal data. We may share necessary data with hosting, cloud, domain, email, payment, support, analytics, security, messaging, advertising, API, automation and AI providers; advisers; authorities; and parties to a business reorganisation.

These recipients receive only the data necessary to perform their function and may vary depending on the contracted service.

We select providers that offer reasonable safeguards and, where appropriate, establish contractual obligations concerning confidentiality, security and use limited to the contracted purposes. A provider may also act as an independent controller for certain data under its own terms.

7. International transfers

Providers and servers may be located outside Uruguay. Transfers use mechanisms allowed by law, such as adequate destinations, consent where applicable, contracts or appropriate clauses. The relevant provider, location and period may vary by service and can be requested.

8. Client-controlled data

For hosting, SaaS, portals, systems, automation, marketing or support, the Client may be controller and Ideasweb processor. The Client warrants a lawful basis and required notices and permissions. Ideasweb uses data to deliver and secure the service, follows documented instructions and may use necessary subprocessors.

9. AI and automation

Ideasweb may use AI tools to assist drafting, classification and automation with data minimisation and risk-based review. We do not make solely automated decisions producing legal or similarly significant effects unless required notices, legal basis and safeguards are in place. Clients must not submit unnecessary, sensitive or unauthorised third-party data.

10. Retention

Data is kept for the relationship and periods needed for billing, support, security, legal compliance and defence of rights. Contract and accounting data follows legal periods. On termination, Client-hosted data may be deleted after the stated export period, ordinarily 30 days, subject to law, temporary backups or a different agreement.

11. Security and incidents

We apply reasonable technical and organisational measures appropriate to service and risk. No system is absolutely secure. Incidents are assessed, contained, documented and notified as required. Clients must protect access and promptly report unauthorised use.

12. Individual rights

Individuals may request access and, where applicable, rectification, updating, inclusion, deletion, objection or challenge to personal assessments. These rights may be exercised free of charge under applicable law. In particular, access may be exercised free of charge at intervals of no less than six months, unless a renewed legitimate interest is duly demonstrated.

Requests will be handled within a maximum of five business days from receipt, in accordance with applicable law. Where verification of the applicant's identity or authority is necessary, only the information strictly required for that purpose will be requested.

Requests may be sent through the contact form or published channels and should identify the applicant, response method, right being exercised and information needed to locate the data. Complaints may be brought before Uruguay's Data Protection Regulatory and Control Unit (URCDP).

13. Children

Services are not directed to minors contracting on their own. Data processed without valid authorisation may be removed or require intervention by a representative.

14. Third-party links

External services have their own privacy practices and are responsible for them.

15. Changes and contact

We may update this Policy for legal, technical or service changes. The new date will be published and material changes reasonably communicated. Privacy questions and rights requests can be submitted through the contact form, Client Area or published Ideasweb email.