This English version is a courtesy translation. If it differs from the Spanish version, the Spanish version governs.

Who is responsible

Certia, based in Quito, Ecuador, is the controller of the personal data it receives through certiaholding.com. For any question about your data, write to certia@fidelity-ec.com or message us on WhatsApp at +593 98 431 9594.

This policy follows Ecuador's Organic Law on Personal Data Protection (LOPDP), published in the Fifth Supplement of Official Registry 459 on May 26, 2021, and its General Regulation, issued by Executive Decree 904 and published in November 2023. The supervisory authority is the Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales).

What we collect and why

We only receive personal data when you choose to send it through one of these channels:

Contact form: name, company, role, email, phone, institution type, interest and message. We store them in our database to answer your business request and follow up on it. To send the form you must check the consent box, which starts unchecked. Another box, optional and also unchecked, signs you up for the newsletter.
WhatsApp widget: before opening WhatsApp you can leave your name, your company (optional) and the topic, with a consent box. We store that as a business contact. The conversation then happens on WhatsApp, a Meta service governed by its own terms.
Certia AI assistant: it answers your questions with an artificial intelligence model through OpenRouter. We configure the providers so they do not retain your messages or use them to train models. We do not store the conversation unless you choose to leave your contact details in the chat and check the consent box. In that case we store your details and a copy of that conversation so our team can follow up.
Newsletter: your email and, if you wish, your name. You must check the box accepting the terms and this policy, and confirm the subscription from the email we send you. Every email includes a one-click unsubscribe link. We keep the version of the text you accepted and the form of origin, to prove your consent.
Rights request form: on the Personal data protection page you can send us a request to exercise your rights. We use what you include to verify your identity, handle the request and keep a record of our answer.
Cookieless visit measurement: we record the page viewed, where the visit came from, the approximate country and the device type, with a daily pseudonym that cannot be reversed. We never store your IP address in the statistics and, if your browser sends a Do Not Track or Global Privacy Control signal, we do not measure your visit.

Do not share sensitive data in the chat, such as health information, financial details or ID numbers, or data about other people.

Our hosting provider also processes technical connection data, such as IP address and browser, to serve and protect the site. To stop abuse we keep, for a short time, an irreversible fingerprint of the IP that is not used to measure visits.

Cookies and local storage

The public pages do not use advertising or tracking cookies, and the internal panel uses session cookies only for Certia staff. If you use the theme button, your browser saves that preference in its local storage. The details are in our Cookie policy.

Legal basis

Your consent, for the contact form, the WhatsApp widget, the details you leave in the chat and the newsletter.
Precontractual measures you request, when we answer a business request or prepare a proposal.
Our legitimate interest in protecting the site, stopping abuse and measuring its use in aggregate, without identifying you.
Compliance with legal obligations, when we handle and document rights requests.

You can withdraw your consent at any time, without affecting earlier processing.

Who else processes your data

We work with processors that handle data on our behalf and follow our instructions:

Vercel: hosting and delivery of the site, in the United States.
Supabase: database and authentication, on AWS servers in the us-east-1 region, in the United States.
Resend: email delivery, in the United States.
OpenRouter: routing of assistant queries, in the United States, and the model providers it sends each one to, with retention and training turned off.
Fal: image generation for editorial content, in the United States. We do not send it personal data.

Meta processes your data when you choose to write to us on WhatsApp, and Google when you write to our corporate email, in both cases under their own terms. We do not sell your data or share it for advertising.

International transfers

Several of these providers process data in the United States. When the destination country has no declaration of an adequate level of protection, the LOPDP requires adequate safeguards. These transfers therefore rely on binding contracts with data protection clauses that hold the provider to a standard equal to or higher than Ecuadorian law.

How long we keep data

Contacts and requests that do not lead to a contract: 24 months. After that we delete or anonymize them.
Newsletter subscription: until you unsubscribe.
Aggregate visit statistics: 13 months.
Rights requests: 5 years, as evidence of how we handled them.

Your rights

The LOPDP gives you the rights of access, rectification and update, deletion, objection, portability and suspension of processing, as well as the right not to be subject to decisions based solely or partly on automated assessments.

You can exercise them with the form on the Personal data protection page or by writing to certia@fidelity-ec.com. We will first confirm that you are the data subject. We answer within 15 days, the period set by the LOPDP. If you are not satisfied with the answer, you can file a complaint with the Superintendency of Personal Data Protection.

Minors

This site is aimed at institutions and professionals, not minors, and we do not knowingly collect their data. If you think a minor has sent us data, write to us and we will delete it.

How we protect data

We use encryption in transit and at rest, least-privilege access by role, row level security in the database and audit logs. We explain these practices in Information security.

Changes to this policy

If this policy changes, we will publish the new version with its effective date. Where the law requires it, we will ask for your consent again before applying the change.