1. Data controller
Huifi S.A. (operator of eMate Cloud)
acts as controller for data we collect directly (website
visitors, sales prospects) and as processor
for data that our enterprise customers load into
platform.emate.cloud.
Contact: [email protected] (designated DPO).
2. Applicable regulations
- EU: GDPR (Regulation 2016/679) + ePrivacy Directive 2009/136/EC
- UK: UK GDPR + Data Protection Act 2018
- Brazil: LGPD (Lei 13.709/2018)
- Argentina: Ley 25.326 + Disposición 11/2006
- Mexico: LFPDPPP
- Colombia: Ley 1581/2012
- California: CCPA / CPRA (limited — we do not sell data)
3. Personal data we process
3.1 Visitors of www.emate.cloud
- Server logs: IP, user-agent, requested page, timestamp (30-day retention)
- UI preferences: language, light/dark theme (in your localStorage only)
- Contact form: name, email, message (24 months from last interaction)
3.2 Dashboard users at platform.emate.cloud
- Account: name, email, tenant, role
- Auth: bcrypt password hash, encrypted TOTP seed, active JWT
- Audit log: actions taken (365 days hot + 7 years WORM)
- Support: tickets and conversations (36 months retention)
3.3 Data processed on behalf of customers
As processor, we handle what the customer loads: domains, DNS configs, DMARC RUA reports (which include sender source IPs — potentially PII in some jurisdictions). Retention is chosen by the customer (90-2555 days) via the dashboard retention policy.
4. Legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Deliver the contracted service | Contract performance (6.1.b) |
| Tax / invoicing obligations | Legal obligation (6.1.c) |
| Security (logs, audit, IR) | Legitimate interest (6.1.f) |
| Commercial communications | Consent (6.1.a) — opt-in |
| Functional cookies / localStorage | Strictly necessary (ePrivacy art 5.3) |
5. Sub-processors
We may rely on third-party sub-processors and infrastructure providers to operate the service, always under confidentiality, data-protection, and security obligations equivalent to our contractual and regulatory commitments.
Relevant third-party categories may include:
| Category | Purpose | Geographic scope |
|---|---|---|
| Infrastructure and hosting | Compute, storage, networking, DNS, and operational continuity | Contracted service regions |
| Delivery and perimeter protection | CDN, WAF, abuse mitigation, and availability | Global distribution |
| Transactional communications | Operational emails and service notifications | Depends on contracted provider |
| Payment processing | Billing, fraud prevention, and subscription management | US/EU or other enabled regions |
| Enrichment and security services | GeoIP, reputation, intelligence, and signal analysis | US/EU or other enabled regions |
| Auxiliary platform services | Support, observability, automation, and complementary platform functions | Depends on contracted provider |
The detailed contractual list of sub-processors, data categories, regions, and transfer mechanisms is provided to customers and qualified prospects during due diligence, contracting, or under NDA where appropriate.
6. Data obtained from third-party APIs
When the Client expressly authorizes an integration, eMate Cloud accesses data hosted on third-party platforms (Microsoft 365, Google Workspace, Google Postmaster Tools, among others) through those providers' authorization flows (OAuth). Access is limited to the scopes strictly necessary for the contracted functionality and can be revoked at any time from the provider's console or from the platform itself.
6.1 Limited Use of Google data
eMate Cloud's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:
- Data obtained from Google APIs is used exclusively to provide and improve the user-facing features that prompted the authorization.
- It is not transferred to third parties except as necessary to provide those features, to comply with a legal obligation, or with the Client's express consent.
- It is not used for advertising, commercial profiling, or model training, and is never sold under any circumstances.
- No humans access this data except with the Client's express consent, for security purposes, to comply with a legal obligation, or when the data is aggregated and anonymized.
Requested scopes and purpose:
| Scope | Purpose | Access |
|---|---|---|
postmaster.traffic.readonly | Read the reputation and spam-rate metrics Google publishes for domains the Client verified in Google Postmaster Tools, to assess compliance with Gmail bulk-sender requirements. | Read-only |
admin.directory.user.readonly | Sync the Client's Workspace user inventory to build the employee roster and assess identity posture (MFA, privileged or suspended accounts) in the awareness and SaaS posture products. | Read-only |
admin.directory.group.readonly | Read groups and their memberships to map roles and access and detect excessive permissions in the posture assessment. | Read-only |
admin.reports.audit.readonly | Read Admin SDK audit logs to detect security events (suspicious sign-ins, configuration changes) in the posture dashboard. | Read-only |
admin.reports.usage.readonly | Read usage reports to assess MFA adoption and per-user security configuration in the posture scoring. | Read-only |
Data obtained this way is retained in accordance with the retention policy described below and is deleted when the integration is revoked or the contract ends.
7. International transfers
For transfers outside the EU/EEA we rely on appropriate international transfer mechanisms, including the 2021 Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Agreement (IDTA) or other valid safeguards for the relevant jurisdiction. Supporting documentation is made available during reasonable contractual review or audit processes.
8. Data retention
| Category | Period |
|---|---|
| HTTP / access logs | 30 days |
| Support tickets | 36 months from closure |
| Inactive accounts | Soft-delete + 90-day hard-purge |
| Audit log | 365 days hot PostgreSQL + 7 years S3 WORM |
| DMARC reports | Tenant-configurable (90-2555 days) |
| Billing | 10 years (AR tax obligation) |
9. Data-subject rights
You can exercise at any time:
- Access: get a copy of your data
- Rectification: correct inaccurate data
- Erasure: "right to be forgotten" (subject to legal obligations)
- Portability: receive your data in structured format (JSON/CSV)
- Object: reject processing based on legitimate interest
- Restriction: limit processing while a complaint is evaluated
- Withdraw consent: at any time without retroactive effect
Requests: write to [email protected]. We respond within 30 calendar days (15 in AR). No fee for legitimate requests.
Authority complaints: EU: your national DPA · UK: ICO · AR: AAIP · BR: ANPD.
10. Security
We implement appropriate technical and organisational measures (TOMs) aligned with ISO 27001 Phase 2 (SOC 2 Type II in progress, target May 2027). Detail in COMPLIANCE.md.
In case of a breach with risk to data-subject rights, we notify the authority within 72 hours and the subject without undue delay (GDPR Art 33/34).
11. Cookies and local storage
We only use strictly-necessary cookies and localStorage.
Full inventory in our
Cookie Policy.
12. Changes
Material changes are notified at least 30 days in advance by email to active users and via a dashboard banner. The current version and history are at this permanent URL.
13. Contact
DPO / Privacy: [email protected]
Data subject requests (DSAR): [email protected]
Security: [email protected]
Sales: [email protected]