Comprehensive Privacy Notice

1. Identity and address of the data controller

The data controller responsible for processing your personal data operates commercially under the brand Olnak, based in Puebla, Puebla, Mexico, with official contact email contacto@olnak.com and telephone +52 222 193 3869.

Controller validation note: Prior to final publication and indexing of this document, the controller must insert its full legal entity name (or full legal name of the individual proprietor) and complete street address (street, number, neighborhood, and postal code in Puebla, Puebla, Mexico) for receiving legal notices.

2. Personal data we collect

Olnak collects only the personal data that you provide directly and voluntarily when using our digital channels, along with the technical data strictly necessary to secure requests:

• Identification and contact data: name, company or business name, email address, optional phone number, and current website URL (if applicable).
• Commercial and operational context data (diagnostic form): selected current situation, free-text description of project needs or context, preference regarding direct content management, and estimated investment range.
• Data shared in the conversational assistant (Olnaky): the text of questions or messages you voluntarily submit (up to 500 characters per message) and the recent context of the active conversation in the current browser tab (up to the last 9 messages in memory, without storing them in cookies or localStorage).
• Data shared through external communication channels: phone number, visible profile information, and message content when you choose to contact us via WhatsApp (+52 222 193 3869), phone call, email (contacto@olnak.com), or when booking a session through our external scheduling link.
• Technical security data: standard HTTP connection metadata and anti-abuse verification tokens generated when submitting the diagnostic form (hCaptcha) or interacting with the conversational assistant (Cloudflare Turnstile).
• Sensitive personal data: Olnak does not request or collect sensitive personal data across any of its channels. Please do not include sensitive personal information in free-text fields or in the chat widget.

3. Purposes of processing

The personal data collected is used exclusively for the following primary purposes, which are necessary to respond to your inquiry and establish the pre-contractual or commercial relationship you request:

• Reviewing the technical and operational context shared in the diagnostic form to assess project feasibility and identify the appropriate operating model.
• Responding to inquiries submitted through the Olnaky conversational assistant, email, telephone, or WhatsApp.
• Scheduling and coordinating diagnostic calls, follow-up meetings, or proposal walkthroughs when requested by the user.
• Preparing and delivering quotes, technical scopes, and service proposals for web development, CMS implementation, managed operations, or custom software.
• Protecting the website infrastructure, contact form, and conversational assistant against automated abuse, spam, or malicious traffic.

4. Secondary purposes

Olnak does not use the data collected on this website for unsolicited mass marketing newsletters, nor does it sell or trade contact databases with third parties. Should secondary marketing purposes be introduced in the future, your express prior consent will be requested, and you may opt out at any time by writing to contacto@olnak.com.

5. Technology processors and third-party services

Based on the current technical audit of https://olnak.com, only the following technology processors and external services are involved when you interact with our contact channels:

• Web3Forms (api.web3forms.com): Form backend service used to receive, process, and route diagnostic form submissions to Olnak's official contact email.
• hCaptcha (js.hcaptcha.com, operated by Intuition Machines, Inc.): Security verification service loaded on demand when you interact with the diagnostic form to confirm that submissions are made by a human.
• Cloudflare Workers and Cloudflare Turnstile (challenges.cloudflare.com, operated by Cloudflare, Inc.): Serverless infrastructure that processes requests from the Olnaky conversational assistant and verifies via Turnstile that queries do not originate from automated bots.
• WhatsApp (wa.me, operated by Meta Platforms, Inc.): When clicking WhatsApp links or scanning the QR code, communication takes place directly on WhatsApp's platform under its own terms and privacy policy.
• Desktop QR Code Generator (api.qrserver.com / goQR.me): When opening the WhatsApp modal dialog on a desktop browser, your browser requests the QR image from this service by passing only Olnak's public WhatsApp contact URL.
• Google Calendar Appointment Schedule (calendar.app.google): If you choose to open the optional scheduling link after submitting the diagnostic form, the booking is handled directly on Google's platform under its privacy policy.

6. Data transfers

Olnak does not sell, rent, or assign your personal data to unrelated third parties. Information transmitted to the technology providers listed above occurs strictly in their capacity as data processors or infrastructure services required to fulfill the primary purposes requested by you, or through your direct action when opening links to external platforms (such as WhatsApp or Google Calendar).

Outside of these operational requirements, your personal data may only be disclosed without consent when legally mandated by a competent authority under the exceptions set forth in the LFPDPPP.

7. Local storage, cookies, and analytics

The Olnak website follows a minimal client-side data collection architecture:

• Visual theme preference (localStorage): The site stores only the local key 'theme' ('dark' or 'light') in your browser's localStorage to remember your chosen color scheme. This value contains no personal data and is never transmitted to external servers.
• Self-hosted web fonts: The site's typefaces (Plus Jakarta Sans and DM Sans) are hosted and served directly from Olnak's domain, avoiding automatic connections to third-party font servers.
• Current status of analytics and advertising cookies: In the current production configuration, Google Tag Manager, Google Analytics, and third-party advertising trackers are not active.
• Two-click privacy facade for embedded media: In blog articles that include external videos, a two-click privacy facade prevents any connection to or cookie placement by third-party video platforms until the user explicitly clicks to play the video.

8. Data retention and security

Personal data received through the diagnostic form or direct contact channels is protected using administrative and technical safeguards designed to prevent loss, misuse, or unauthorized access, and is retained for the time necessary to address your inquiry, follow up on commercial proposals, and comply with applicable contractual and legal obligations.

In the Olnaky conversational assistant, message history is kept only in the temporary memory of the active browser tab during your session and is cleared when the tab is closed or reloaded.

Controller validation note: Specify the exact internal retention and blocking period for diagnostic submissions that do not result in a service agreement prior to final deletion.

9. ARCO rights and revocation of consent

Under the LFPDPPP in force in Mexico, you have the right to know what personal data we hold about you and how it is used (Access); request correction of inaccurate, outdated, or incomplete information (Rectification); request deletion of your data from our records when you consider it is not being used in accordance with statutory principles and duties (Cancellation); object to the processing of your data for specific purposes (Objection); and revoke the consent you have granted.

To exercise your ARCO rights or revoke your consent, send a request to contacto@olnak.com including:

• Full name of the data subject and email address to receive the response.
• Copy of an official identification document confirming your identity or, where applicable, legal representation.
• A clear and specific description of the personal data regarding which you seek to exercise ARCO rights or revoke consent.
• Any additional detail that helps locate your data (such as the approximate date you submitted the diagnostic form or contacted us).

10. Response timeframes and oversight authority

Olnak will communicate its determination within a maximum of 20 business days from the date a complete request is received. If the request is procedentes (valid), it will be executed within the following 15 business days, in accordance with the statutory timeframes of the LFPDPPP.

If you believe your right to personal data protection has been infringed, you may contact the competent Mexican federal oversight authority for personal data held by private parties under current legislation (Secretaría Anticorrupción y Buen Gobierno).

11. Limiting use or disclosure and changes to this notice

You may request limitations on the use or disclosure of your personal data at any time by writing directly to contacto@olnak.com.

Olnak may update this Privacy Notice to reflect legislative changes, adjustments to our operating models, or the introduction of new technical services. Any updates will be published at https://olnak.com/en/privacy-notice (and in Spanish at https://olnak.com/aviso-de-privacidad) along with the corresponding last-updated date.

12. Information pending controller validation

Before completing legal review and removing the validation notice, the controller of Olnak must confirm and incorporate the following details:

• Full legal corporate name (if a legal entity) or full legal name of the proprietor (if an individual).
• Complete street address in Puebla, Puebla, Mexico for statutory privacy notice purposes.
• Specific retention period for diagnostic inquiries that do not lead to a signed contract.
• Confirmation of whether the Olnaky Cloudflare Worker retains temporary server-side diagnostic logs and, if so, their exact expiration timeframe.