Information about the processing of personal data, the terms of use, and the legal framework applicable to gopenux.com.
Last updated: · version 3.3
Two, and both are technical: gpx_lang, which remembers the language you pick in the selector, and __cf_bm, set by the network that serves the site to tell human traffic apart from automated traffic, which lasts 30 minutes. There are no analytics or advertising cookies: site analytics run without cookies, on self-hosted Umami. Section 7 describes both.
No. Both cookies on the site are exempt from consent under Article 22.2 of the LSSI-CE, which does not require it for cookies needed to provide a service the user has expressly requested: one stores the language preference you set yourself, and the other protects the site against automated traffic. That is why there is no banner. Section 7 describes them.
With Umami, a self-hosted open source tool, configured to minimize and anonymize the IP address through a hash function with a rotating salt. Section 7 sets out the conditions under which this analytics setup falls outside the GDPR and the legal basis that applies in the meantime.
No. The website doesn't use advertising or commercial profiling cookies, or any third-party service for that purpose.
Voluntarily following the user information standard of Article 10 of Spain's Law 34/2002, of , on Information Society Services and Electronic Commerce (LSSI-CE), and Colombia's Law 1581 of , the following identifying details of this website's owner are provided:
This legal notice governs access to and use of the website gopenux.com (hereinafter, "the website"), owned by Gopenux Lab S.A.S. The website's purpose is to:
Accessing and browsing the website confers the status of user. This legal notice describes the terms on which Gopenux Lab makes the site available to the public; it is not a contract between the parties and does not replace those Gopenux Lab enters into with its clients. In using the website, the user agrees to:
Gopenux Lab isn't liable for:
These exclusions apply to the extent permitted by applicable law, and in no case reach damage caused by wilful misconduct or gross negligence on the part of Gopenux Lab, nor rights granted to the user by mandatory rules.
This legal notice is governed by Colombian law. The terms of use of this website do not replace the service agreements Gopenux Lab enters into with its clients: the governing law and forum of those agreements are whatever each agreement establishes, and they prevail over this notice.
For users located in Spain, the European Union or the United Kingdom, the mandatory consumer protection rules of their place of residence apply, and the consumer retains whatever forum those rules grant them. For any dispute concerning the use of this website not covered by the above, the parties submit to the courts of Cúcuta, Norte de Santander (Colombia).
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and Colombia's Statutory Law 1581 of , the data controller of your personal data is:
Given its size and the type of processing it carries out, Gopenux Lab isn't required to appoint a DPO under Art. 37 GDPR. Any question related to data protection can be sent to the email address given in the previous section.
The personal data we may collect through this website comes from its three forms: the general contact form and the forms for the two ways to start, "You have an idea" and "You already have a product". All three are used exclusively to respond to your request.
| Data category | Types of data | Source |
|---|---|---|
| Identification and contact data | Name and email address; company, if you choose to provide it | General contact form and the forms for the two ways to start |
| Content of the request | The message and the form's context fields — for example, industry sector or the system the inquiry is about | The same three forms |
| Browsing data | IP address, browser type | Automatic (server logs) |
Of the two cookies on the website, the language preference one stores nothing but a language code and contains no personal data; the one that protects against automated traffic carries an encrypted value that only our network provider can read, and calculating it involves your IP address and the technical characteristics of your request. The analytics install none. Section 7 covers all three.
Besides what you write or select, we record the domain you arrived from — for example linkedin.com, a search engine, or “direct” if you typed the address — for the sole purpose of knowing which channels bring us enquiries. We do not store the full address, so we keep neither any terms you may have searched for nor any campaign identifier, and we do not record your browser, your operating system or your IP address. The legal basis is our legitimate interest in understanding how effective our outreach channels are (Article 6(1)(f) GDPR).
Gopenux Lab guarantees that personal data processing is carried out in accordance with the following principles:
Your personal data is processed for the following purposes:
The website measures its own usage — page views, traffic source — with Umami, an open source tool self-hosted on Gopenux Lab's own infrastructure. This analytics setup doesn't install cookies, so it doesn't require your consent under Article 22.2 of the LSSI-CE. Its legal basis under the GDPR, and the conditions under which it can be considered anonymous, are explained in section 7.
The following purposes are only carried out if you give your express consent:
| Purpose | Retention period | Legal basis |
|---|---|---|
| Inquiries that don't lead to a contract | 1 year from the last communication | Legitimate interest |
| Contractual relationship | Duration of the contract + 5 years | Legal obligation (statute of limitations) |
| Tax and accounting data | 6 years from the last entry | Legal obligation (Commercial Code) |
The processing of your personal data is based on the following legal grounds, in accordance with Art. 6 GDPR and Article 6 of Colombia's Law 1581 of :
For sending satisfaction surveys to clients with an active contractual relationship, where you give your express consent. That consent can be withdrawn at any time, without retroactive effect, by writing to privacidad@gopenux.com.
For handling information requests, preparing business proposals, and performing service agreements.
For complying with tax, accounting and billing obligations under Colombian law and, where applicable, Spanish law.
For the following purposes, weighing the interests at stake in each case:
Website analytics doesn't require the cookie consent of Article 22.2 of the LSSI-CE, because it installs none. Its legal basis under the GDPR — legitimate interest for as long as it isn't verified that its configuration produces anonymous information within the meaning of Recital 26, or no subjection to the GDPR once that's verified — is explained in section 7.
Gopenux Lab weighs, for each of these purposes, whether the legitimate interest overrides the rights and freedoms of data subjects, having regard to the B2B context of its activity and the reasonable expectations of professional users.
Gopenux Lab is a company incorporated in Colombia, with no establishment in the European Union, that provides services to businesses in different countries. When a person in the European Union provides us with their data through a website form, the GDPR applies directly to that processing by virtue of its Article 3.2, regardless of where the controller is established; Gopenux Lab S.A.S. is the data controller for that processing.
The website is hosted on infrastructure provided by DigitalOcean, LLC, headquartered in the United States: the server that receives the forms is located in the United States. This involves two distinct data flows.
The United States has an adequacy decision from the European Commission for entities that have joined the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of ). DigitalOcean, LLC, the website's hosting provider, is self-certified under that framework and additionally incorporates standard contractual clauses (SCC) in its data processing agreement as a fallback safeguard, applicable if the certification or the adequacy decision itself were to cease to be in force.
This adequacy decision is being challenged before the Court of Justice of the European Union. Gopenux Lab is monitoring these proceedings and will update this section if the Court rules on the matter.
For the internal notification channel, the main safeguard is technical rather than contractual: the content travels encrypted end to end with a key Discord does not hold, so the provider has no access to any personal data in the clear. This measure applies in addition to whatever transfer safeguards are applicable, not instead of them.
In Colombia, personal data processing is governed by:
Gopenux Lab S.A.S. complies with these rules in Colombia, its country of domicile. Colombia also takes part in the Ibero-American Data Protection Network (RIPD), a cooperation network among the region's data protection authorities that promotes common best-practice standards. It is a cooperation framework with no binding force and no legal equivalence to a European Commission adequacy decision under Article 45 of the GDPR: only the European Commission can produce that effect for transfers from the European Union.
Gopenux Lab currently relies on the following providers to operate the website:
If Gopenux Lab incorporates any other service provider located outside Colombia that processes personal data on its behalf in the future, it will require equivalent contractual guarantees and verify that a valid transfer mechanism is in place: a European Commission adequacy decision, standard contractual clauses (SCC), or binding corporate rules (BCR).
In accordance with Article 32 GDPR and Article 4, point (g), of Law 1581 of 2012, Gopenux Lab implements the following technical and organizational security measures:
If a security breach affecting personal data occurs, Gopenux Lab will notify the competent supervisory authority within a maximum of 72 hours, and the affected data subjects when the breach is likely to result in a high risk to their rights and freedoms.
Under the GDPR and the LOPDGDD, you have the right to:
Under Colombian law, data subjects have the right to:
To exercise any of these rights, write to privacidad@gopenux.com stating clearly which right you wish to exercise.
Please write from the same email address you used to contact us: that match is enough verification in most cases and we need nothing further. Only if there were reasonable doubts about your identity — for instance, if the request arrives from a different address — will we ask for additional information, strictly what is needed to resolve that doubt, in accordance with Article 12.6 of the GDPR. If checking an identity document became indispensable in that case, we will verify it without keeping a copy. If you are acting on behalf of someone else, we will need the document evidencing your authority.
We will respond within one month of receipt, extendable by two further months in particularly complex cases, informing you accordingly: that is the GDPR deadline, applicable to people in the European Union and the United Kingdom. If you exercise your rights under Colombia's Law 1581 of 2012, the deadline is ten (10) business days for inquiries and fifteen (15) business days for complaints, extendable by up to eight (8) further business days, informing you before the first deadline expires.
If you are not satisfied with our response, you can complain to the supervisory authority of the country where you live or work:
The contents of this website — text, graphics, illustrations, icons, logos, design and source code — belong to Gopenux Lab, except for the third-party components used under free licenses and identified as such, among them the Inter, Space Grotesk and Archivo typefaces, distributed under the OFL 1.1, whose text ships alongside the files at /assets/fonts/OFL.txt. Our own contents are protected by:
The following actions are expressly prohibited without Gopenux Lab's written authorization:
The trade names, trademarks and logos appearing on the website are owned by Gopenux Lab or by third parties. Access to the website doesn't grant any right over these distinctive signs. Any use without express authorization is prohibited.
Gopenux Lab grants the user a non-exclusive, non-transferable and revocable license, limited to viewing the website's content for personal, non-commercial purposes. Any other use requires prior written authorization.
This website and Gopenux Lab's services are aimed exclusively at businesses and professionals (B2B). We don't intentionally collect data from minors.
If we discover that we've collected data from a minor without their legal representative's consent, we'll delete it immediately. If you're aware that a minor has provided personal data, please contact us so we can delete it.
Gopenux Lab reserves the right to modify this privacy policy and legal notice to adapt it to legislative, case-law or business-practice developments.
Any substantial change will be communicated to users through:
The current version will always be the one published at this URL. We recommend checking this page periodically to stay informed of any changes.
For any question, inquiry or complaint related to this legal notice, the privacy policy, or the processing of your personal data:
Before turning to the supervisory authorities, we invite you to contact us to try to resolve any dispute amicably. We commit to:
If you are not satisfied with our response, you can complain to the supervisory authority of the country where you live or work: