Privacy policy

1. Who is responsible

The party responsible for handling the data on this website is DTEAM System Solutions, based in Piura, Peru.

You can contact us at [email protected] or on WhatsApp at +51 972 454 226.

2. What data we collect and why

a) If you write to us on WhatsApp or by email

We receive your name, your phone number or email and the content of your message. We use them only to reply, send proposals and follow up on your enquiry.

b) If you scan an NFC card or a QR code

When someone taps their phone on a card or scans its QR code, a link on our site (tubotpersonal.uk/t/…) opens and sends them to the business review page. At that moment we store:

• The date and time.
• Whether it was NFC or QR.
• The approximate country, region and city, which the Cloudflare network infers from the connection.
• The device type (phone, tablet or computer), the operating system and the browser.
• A trimmed IP address: we never store the full IP. For IPv4 we remove the last two blocks (for example, 190.42.xxx.xxx).
• An anonymous identifier: an irreversible cryptographic hash of the trimmed IP and the browser, combined with a secret key that only we hold. It lets us count distinct visitors without knowing who each one is.

We do not ask the person scanning for names, emails or phone numbers, and we do not store the full browser string (user agent). We use this data to produce aggregated statistics for the business that owns the card and to prevent abuse, such as automated or repeated visits.

c) Cookies, analytics and local storage

The public website uses Google Analytics 4 (Google LLC, United States) only if you accept in the cookie notice. If you accept, Google Analytics sets its own cookies (_ga and _ga_…) and measures page views, where you come from (for example Google, WhatsApp or a direct link), device type, system and browser, approximate country or city, and clicks on our WhatsApp, email and copy buttons. We do not measure names, phone numbers or email addresses, and we do not use this data for advertising. If you reject, or do not answer, Google Analytics is not loaded and no data is sent to Google, and the site works the same.

We store your choice in your browser's local storage (localStorage) for 6 months; after that we will ask you again. You can change it at any time with the Cookie settings link in the footer; if you reject, we delete this site's Google Analytics cookies. Scanning an NFC card or a QR code does not set cookies. Typefaces are served from our own site. You choose the language with the ES/EN button, which is a plain link, and it is not remembered.

The internal panel we use to manage the cards uses a Cloudflare Access session cookie, only for our authorised staff; website visitors do not receive it.

3. Which providers we work with

To provide the service we use external providers that may process data on our behalf:

• Cloudflare: website hosting, security, content delivery and the database where cards and their statistics are stored. By the nature of the connection, Cloudflare technically processes the IP address of whoever visits the site.
• Zoho: the email service for [email protected].
• Meta (WhatsApp): messaging when you write to us or chat with a chatbot on WhatsApp. It is also governed by its own policies.
• Google Analytics (Google LLC): website analytics, only if you accept cookies. It is also governed by Google's privacy policy.
• Cloudflare cdnjs: a script library loaded only by our internal panel, not by the public website.
• Google: when a card is scanned, the person is taken to the Google review page, which is governed by Google's privacy policy.

Some of these providers are located outside Peru (for example in the United States, where Google LLC processes Google Analytics data, or other countries), so your data may be subject to international transfer. We only work with providers that apply appropriate security measures.

4. What client businesses receive

Businesses that use our cards only receive aggregated, anonymous reports (for example, total scans, busiest hours and days, NFC versus QR share, cities and device types). We never give them IP addresses, visitor identifiers or individual data.

5. WhatsApp chatbot for a business

When we set up a chatbot for a business, that business is the data controller for its own customers' personal data and decides how it is used. DTEAM System Solutions acts as the data processor: it handles that data only on the business's behalf and following its instructions. If you are a customer of one of those businesses and want to exercise your rights, please contact that business first.

6. How long we keep data

• Contact messages and emails: 12 months from the last contact, unless the person becomes a client; in that case, for as long as the business relationship lasts.
• Google Analytics data (only if you accept): up to 14 months; after that Google deletes it automatically.
• NFC/QR card scan data: 24 months. After that, the detail is deleted and only anonymous totals are kept.

After those periods, the data is deleted. The anonymous scan totals for each card cannot identify anyone.

7. Your rights

You may exercise your rights of access, rectification, cancellation and objection, and withdraw your consent at any time. Write to [email protected] with your name, the right you want to exercise and a way to reply. We respond within the deadlines set by law.

Because we do not identify people who scan a card, we may not be able to locate their individual data; if so, we will explain it to you.

If you believe we did not handle your request or that your rights are being infringed, you can file a complaint with Peru's National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales), part of the Ministry of Justice and Human Rights.

8. Security and changes

We apply technical and organisational measures to protect data: encrypted connections (HTTPS), panel access restricted to authorised staff with email verification, minimal data and anonymisation of the IP and of the visitor identifier.

We may update this policy when the way we handle data changes. The current version will be published on this page with its update date.