On this page
1. Our role: controller vs. processor2. Personal data we collect3. Purposes and legal bases4. AI processing and subprocessors5. International transfers6. Retention7. Security8. Your rights9. Children10. Changes to this policy11. ContactThis Privacy Policy explains how José María González Gómez, established in Spain ("DatumKeep", "we", "us"), processes personal data in connection with the website datumkeep.com and the DatumKeep platform (together, the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR).
1. Our Role: Controller vs. Processor
- Controller. For personal data of website visitors, prospects, and account holders (e.g., registration data, communications, usage data), DatumKeep acts as the data controller.
- Processor. For personal data contained in content that business customers upload to the platform (e.g., names of employees appearing in incident or 8D reports — "Customer Content"), DatumKeep acts as a data processor on behalf of the customer, who is the controller. Such processing is governed by our Data Processing Agreement ("DPA"), available on request at contact@datumkeep.com. If you have questions about Customer Content, please contact the organization that uploaded it.
2. Personal Data We Collect
Data you provide:
- Account and registration data: name, business email, company, role, password (stored hashed).
- Communications: emails, support requests, demo or pilot inquiries.
- Customer Content: documents and records uploaded to the platform, which may incidentally contain personal data (processed on the customer's behalf — see Section 1).
If a booking link is offered after you submit a demo or contact form, the scheduling provider behind it receives the name and email you give when you book.
Data you provide through the whitepaper, readiness and booking pages:
- Whitepaper form: your email address and, if you give it, your first name. Booking: the name and email you enter when you book a Scaling readiness check.
- Your answer to the optional use-case question on the booking form.
- The campaign source (UTM) parameters and the referrer of the link you arrived from.
- We do not store the time slot you chose. Our scheduling provider keeps the booking details itself (see the subprocessor table in Section 4).
Data collected automatically:
- Technical and usage data: IP address, browser and device information, log data, pages and features used, timestamps.
- Cookies: this website uses strictly necessary cookies only. We do not use advertising or third-party tracking cookies.
We do not intentionally collect special categories of personal data and ask customers not to upload them.
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing and operating the Service, account management | Performance of a contract (6(1)(b)) |
| Responding to inquiries, demos, and pilot requests | Contract / pre-contractual steps (6(1)(b)) or legitimate interest (6(1)(f)) |
| Security, abuse prevention, logging, tenant isolation | Legitimate interest (6(1)(f)) |
| Product improvement and aggregated analytics | Legitimate interest (6(1)(f)) |
| Marketing communications to business contacts | Legitimate interest (6(1)(f)) or consent (6(1)(a)), with opt-out at any time |
| Compliance with legal obligations | Legal obligation (6(1)(c)) |
| Sending you the whitepaper you requested in a single delivery email | Performance of a contract / pre-contractual steps (6(1)(b)) |
| Optional marketing list: product news and related content by email | Consent (6(1)(a)), given by ticking the box and then pressing Confirm on the download page our email links to; we record the date and time of the confirmation |
| Handling a Scaling readiness check booking: our scheduling provider sends the booking confirmation; we send you a proposal email and alert our team | Pre-contractual steps (6(1)(b)) |
| Lead and contact management for demo requests and bookings | Legitimate interest (6(1)(f)); the newsletter relies on consent, as stated above |
Processing of Customer Content is performed on documented instructions of the customer under the DPA.
4. AI Processing and Subprocessors
Our application, live database and cache are hosted in the European Union (Netherlands, region europe-west4). Three pre-migration database volumes in Singapore are pending a verified backup and deletion.
The Service uses third-party providers to deliver its functionality, including AI model providers for analysis and embedding generation. The core Service uses the subprocessors below. Providers used only when an optional feature is switched on (web-search enrichment and our own sales prospecting) are listed in the DPA.
| Provider | Purpose | Location / transfer mechanism |
|---|---|---|
| Railway Corp. | Application and database hosting | European Union (Netherlands, europe-west4) — provider is a US company; EU Standard Contractual Clauses apply |
| Vercel Inc. | Website hosting and delivery | US company, global edge network; EU Standard Contractual Clauses apply — data-residency position to be confirmed |
| Cloudflare, Inc. | File and attachment storage (R2) | Migration to an EU-jurisdiction bucket in progress; current location not yet verified |
| Anthropic Ireland, Limited / Anthropic PBC | AI-assisted analysis (large language models) | United States — EU Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework |
| OpenAI (OpenAI Ireland Ltd / OpenAI LLC) | Text embeddings for search | United States — EU Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework |
| Resend, Inc. | Transactional email delivery | Region and transfer basis to be confirmed |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics | United States — EU Standard Contractual Clauses |
| Plausible Insights OÜ | Cookieless website analytics on the public marketing pages (not inside the application) | European Union — EU-hosted, cookieless; your IP address and user-agent are used transiently (hashed with a daily-rotating salt, no cookie) and events pass through a same-origin proxy on our host; to be confirmed at signing |
| Cal.com, Inc. | Scheduling of Scaling readiness check bookings. Data: when the booking calendar loads on the readiness page, your IP address, browser information and the campaign source (UTM) parameters; if you book, also the name and email you enter and your free-text answer on the booking form | United States — a transfer outside the EU. We are requesting Cal.com’s data processing agreement; the transfer mechanism (EU Standard Contractual Clauses or the EU–US Data Privacy Framework) is not yet confirmed |
Data submitted to our AI providers through their business APIs is not used by those providers to train their models, in accordance with their applicable API terms. We will maintain an up-to-date subprocessor list and, for platform customers, provide notice of changes as set out in the DPA.
5. International Transfers
Where personal data is transferred outside the European Economic Area (for example, to providers in the United States), we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with supplementary measures where needed.
Our two AI subprocessors process data in the United States: Anthropic (large language models for analysis) and OpenAI (text embeddings for search). Other US-based providers in the table above do too. Each transfer is covered by a data processing agreement and the EU Standard Contractual Clauses, and by the EU–US Data Privacy Framework where the provider is certified, except where the table above states that the data processing agreement or the transfer basis is not yet in place or still to be confirmed.
6. Retention
- Account data: for the duration of the account and up to twelve (12) months after closure, unless longer retention is legally required.
- Customer Content: for the duration of the customer agreement; at its end, read-only for 30 days and then fully deleted, as set out in the DPA.
- Logs and technical data: typically ninety (90) days.
- Whitepaper, demo request and booking contacts: kept for 24 months without activity, then deleted.
- A newsletter unsubscribe removes only newsletter data (newsletter tags and attribution). We keep a record of the consent you gave and the date you withdrew it, as proof of consent. If you are also an active prospect (a demo request or a booking), your contact and sales history is kept under legitimate interest for lead management until 24 months without activity, and then deleted. A newsletter-only contact is left with just the email address, the withdrawal date and the consent record. That withdrawal record is itself deleted after 24 months without activity; we do not keep a permanent suppression list.
- Communications: as long as necessary for the purpose and applicable limitation periods.
7. Security
We apply appropriate technical and organizational measures, including encryption in transit, access controls, tenant isolation at the database level (row-level security), hashed credentials, and least-privilege access. No system is completely secure; we will notify affected parties of personal data breaches as required by the GDPR.
8. Your Rights
Under the GDPR you have the right to access, rectify, erase, and receive a copy of your personal data, to restrict or object to processing (including direct marketing), and to withdraw consent at any time where processing is based on consent. To exercise your rights, contact contact@datumkeep.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) or the authority of your place of residence.
You can withdraw your consent to the newsletter at any time, free of charge: use the unsubscribe option in your mail client (the whitepaper delivery email sent to confirmed subscribers carries a List-Unsubscribe header), reply "unsubscribe" to that email, or write to contact@datumkeep.com. Withdrawal does not affect the lawfulness of processing carried out before it.
To have your contact data erased, write to contact@datumkeep.com.
Where DatumKeep acts as processor for Customer Content, we will forward requests to the relevant customer (controller) and assist them as required.
9. Children
The Service is intended for business users and is not directed at anyone under 18. We do not knowingly collect personal data from minors.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date indicates the latest version. For material changes, we will provide notice through the Service or by email.
11. Contact
José María González Gómez
Spain
Email: contact@datumkeep.com