Legal
Information about the processing of personal data, the terms of use, and the legal framework applicable to gopenux.com.
Last updated: · version 1.0
Two, and both are technical: gpx_lang, which remembers the language you pick in the selector, and __cf_bm, set by the network that serves the site to tell human traffic apart from automated traffic, which lasts 30 minutes. There are no analytics or advertising cookies, because the website runs no analytics at all. Section 7 describes both.
No. Both cookies on the site are exempt from consent under Article 22.2 of the LSSI-CE, which does not require it for cookies needed to provide a service the user has expressly requested: one stores the language preference you set yourself, and the other protects the site against automated traffic. That is why there is no banner. Section 7 describes them.
No. The website loads no analytics tool, its own or anyone else's: it counts no page views, builds no audience statistics and sets no identifier for that purpose. Section 7 sets this out.
No. The website doesn't use advertising or commercial profiling cookies, or any third-party service for that purpose.
Voluntarily following the user information standard of Article 10 of Spain's Law 34/2002, of , on Information Society Services and Electronic Commerce (LSSI-CE), and Colombia's Law 1581 of , the following identifying details of this website's owner are provided:
This legal notice governs access to and use of the website gopenux.com (hereinafter, "the website"), owned by Gopenux Lab S.A.S. The website's purpose is to:
Accessing and browsing the website confers the status of user. This legal notice describes the terms on which Gopenux Lab makes the site available to the public; it is not a contract between the parties and does not replace those Gopenux Lab enters into with its clients. In using the website, the user agrees to:
Gopenux Lab isn't liable for:
These exclusions apply to the extent permitted by applicable law, and in no case reach damage caused by wilful misconduct or gross negligence on the part of Gopenux Lab, nor rights granted to the user by mandatory rules.
This legal notice is governed by Colombian law. The terms of use of this website do not replace the service agreements Gopenux Lab enters into with its clients: the governing law and forum of those agreements are whatever each agreement establishes, and they prevail over this notice.
For users located in Spain, the European Union or the United Kingdom, the mandatory consumer protection rules of their place of residence apply, and the consumer retains whatever forum those rules grant them. For any dispute concerning the use of this website not covered by the above, the parties submit to the courts of Cúcuta, Norte de Santander (Colombia).
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and Colombia's Statutory Law 1581 of , the data controller of your personal data is:
Given its size and the type of processing it carries out, Gopenux Lab isn't required to appoint a DPO under Art. 37 GDPR. Any question related to data protection can be sent to the email address given in the previous section.
The personal data we may collect through this website comes from its two forms, one per way to start: "You have an idea" and "You already have a product". Both collect the same fields and are used exclusively to respond to your request.
| Data category | Types of data | Source |
|---|---|---|
| Identification and contact data | Name and email address; company, if you choose to provide it | The forms for the two ways to start |
| Content of the request | The message you write in the form | The same two forms |
| Browsing data | IP address, browser type | Automatic (server logs) |
Of the two cookies on the website, the language preference one stores nothing but a language code and contains no personal data; the one that protects against automated traffic carries an encrypted value that only our network provider can read, and calculating it involves your IP address and the technical characteristics of your request. The analytics install none. Section 7 covers all three.
Besides what you write or select, we record the domain you arrived from — for example linkedin.com, a search engine, or “direct” if you typed the address — for the sole purpose of knowing which channels bring us enquiries. We do not store the full address, so we keep neither any terms you may have searched for nor any campaign identifier, and we do not record your browser, your operating system or your IP address. The legal basis is our legitimate interest in understanding how effective our outreach channels are (Article 6(1)(f) GDPR).
Gopenux Lab guarantees that personal data processing is carried out in accordance with the following principles:
Your personal data is processed for the following purposes:
The website doesn't measure its own usage. No analytics tool is loaded, so under this purpose there is no processing to describe, nothing that would require your consent under Article 22.2 of the LSSI-CE, and no legal basis to give under the GDPR. Section 7 sets out what the site does load.
The following purposes are only carried out if you give your express consent:
| Purpose | Retention period | Legal basis |
|---|---|---|
| Enquiries that don't lead to a contract | 1 year from the last communication | Legitimate interest |
| Contractual relationship | Duration of the contract + 5 years | Legal obligation (statute of limitations) |
| Tax and accounting data | 6 years from the last entry | Legal obligation (Commercial Code) |
The processing of your personal data is based on the following legal grounds, in accordance with Art. 6 GDPR and Article 6 of Colombia's Law 1581 of :
For sending satisfaction surveys to clients with an active contractual relationship, where you give your express consent. That consent can be withdrawn at any time, without retroactive effect, by writing to privacidad@gopenux.com.
For handling information requests, preparing business proposals, and performing service agreements.
For complying with tax, accounting and billing obligations under Colombian law and, where applicable, Spanish law.
For the following purposes, weighing the interests at stake in each case:
Gopenux Lab weighs, for each of these purposes, whether the legitimate interest overrides the rights and freedoms of data subjects, having regard to the B2B context of its activity and the reasonable expectations of professional users.
Gopenux Lab is a company incorporated in Colombia, with no establishment in the European Union, that provides services to businesses in different countries. When a person in the European Union provides us with their data through a website form, the GDPR applies directly to that processing by virtue of its Article 3.2, regardless of where the controller is established; Gopenux Lab S.A.S. is the data controller for that processing.
The website is hosted on infrastructure provided by DigitalOcean, LLC, headquartered in the United States: the server that receives the forms is located in the United States. This involves two distinct data flows.
The United States has an adequacy decision from the European Commission for entities that have joined the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of ). DigitalOcean, LLC, the website's hosting provider, is self-certified under that framework and additionally incorporates standard contractual clauses (SCC) in its data processing agreement as a fallback safeguard, applicable if the certification or the adequacy decision itself were to cease to be in force.
This adequacy decision is being challenged before the Court of Justice of the European Union. Gopenux Lab is monitoring these proceedings and will update this section if the Court rules on the matter.
For the internal notification channel, the main safeguard is technical rather than contractual: the content travels encrypted end to end with a key Discord does not hold, so the provider has no access to any personal data in the clear. This measure applies in addition to whatever transfer safeguards are applicable, not instead of them.
In Colombia, personal data processing is governed by:
Gopenux Lab S.A.S. complies with these rules in Colombia, its country of domicile. Colombia also takes part in the Ibero-American Data Protection Network (RIPD), a cooperation network among the region's data protection authorities that promotes common best-practice standards. It is a cooperation framework with no binding force and no legal equivalence to a European Commission adequacy decision under Article 45 of the GDPR: only the European Commission can produce that effect for transfers from the European Union.
Gopenux Lab currently relies on the following providers to operate the website:
If Gopenux Lab incorporates any other service provider located outside Colombia that processes personal data on its behalf in the future, it will require equivalent contractual guarantees and verify that a valid transfer mechanism is in place: a European Commission adequacy decision, standard contractual clauses (SCC), or binding corporate rules (BCR).
In accordance with Article 32 GDPR and Article 4, point (g), of Law 1581 of 2012, Gopenux Lab implements the following technical and organisational security measures:
If a security breach affecting personal data occurs, Gopenux Lab will notify the competent supervisory authority within a maximum of 72 hours, and the affected data subjects when the breach is likely to result in a high risk to their rights and freedoms.
Under the GDPR and the LOPDGDD, you have the right to:
Under Colombian law, data subjects have the right to:
To exercise any of these rights, write to privacidad@gopenux.com stating clearly which right you wish to exercise.
Please write from the same email address you used to contact us: that match is enough verification in most cases and we need nothing further. Only if there were reasonable doubts about your identity — for instance, if the request arrives from a different address — will we ask for additional information, strictly what is needed to resolve that doubt, in accordance with Article 12.6 of the GDPR. If checking an identity document became indispensable in that case, we will verify it without keeping a copy. If you are acting on behalf of someone else, we will need the document evidencing your authority.
We will respond within one month of receipt, extendable by two further months in particularly complex cases, informing you accordingly: that is the GDPR deadline, applicable to people in the European Union and the United Kingdom. If you exercise your rights under Colombia's Law 1581 of 2012, the deadline is ten (10) working days for enquiries and fifteen (15) working days for complaints, extendable by up to eight (8) further working days, informing you before the first deadline expires.
If you are not satisfied with our response, you can complain to the supervisory authority of the country where you live or work:
The contents of this website — text, graphics, illustrations, icons, logos, design and source code — belong to Gopenux Lab, except for the third-party components used under free licences and identified as such, among them the Inter, Space Grotesk and Archivo typefaces, distributed under the OFL 1.1, whose text ships alongside the files at /assets/fonts/OFL.txt, and the photographs on the service and entry cards, dedicated to the public domain under CC0 1.0 and edited by us. Our own contents are protected by:
The following actions are expressly prohibited without Gopenux Lab's written authorisation:
The trade names, trademarks and logos appearing on the website are owned by Gopenux Lab or by third parties. Access to the website doesn't grant any right over these distinctive signs. Any use without express authorisation is prohibited.
Gopenux Lab grants the user a non-exclusive, non-transferable and revocable licence, limited to viewing the website's content for personal, non-commercial purposes. Any other use requires prior written authorisation.
This website and Gopenux Lab's services are aimed exclusively at businesses and professionals (B2B). We don't intentionally collect data from minors.
If we discover that we've collected data from a minor without their legal representative's consent, we'll delete it immediately. If you're aware that a minor has provided personal data, please contact us so we can delete it.
Gopenux Lab reserves the right to modify this privacy policy and legal notice to adapt it to legislative, case-law or business-practice developments.
Any substantial change will be communicated to users through:
The current version will always be the one published at this URL. We recommend checking this page periodically to stay informed of any changes.
For any question, enquiry or complaint related to this legal notice, the privacy policy, or the processing of your personal data:
Before turning to the supervisory authorities, we invite you to contact us to try to resolve any dispute amicably. We commit to:
If you are not satisfied with our response, you can complain to the supervisory authority of the country where you live or work:
Two ways to begin, depending on what you have in front of you today. Answered within one working day.