Política de Privacidad y Seguridad de la Información.

Great stories havepersonality. Consider telling a great story full of personality. Writing a story with personality for potential clients will help you maintain relationships and connections. This shows in small quirks like word or phrase choices. Write from your perspective, not from someone else's experience.

1. PurposeAt GoAlma, we are committed to protecting the privacy, integrity, and confidentiality of the information of our users, clients, and partners. This policy establishes the principles that govern the collection, storage, processing, and protection of data on our platform, in accordance with European regulations and international information security standards.

2. ScopeThis policy applies to all personal, technical, operational, and environmental data collected, processed, or stored through the products and services offered by GoAlma, including:

• Registered users
• Corporate clients
• Environmental consultants
• Files, evidence, or documents uploaded to the platform

3. Regulatory FoundationsThis policy aligns with:

• General Data Protection Regulation (GDPR) – EU 2016/679
• Corporate Sustainability Reporting Directive (CSRD) – 2022/2464ISO/IEC 27001 and 27701
• Principles of minimization, transparency, traceability, and security applicable to the processing of sensitive information within the framework of environmental compliance and sustainability.
• CCPA/CPRA - California. CDPA - Virginia, CPA - Colorado.

4. Principles of Privacy and SecurityGoAlma bases its data management model on the following principles:

a) Lawfulness, fairness, and transparency: We only collect necessary data with clear consent. We inform users about the use and purpose of their data.

b) Purpose limitation: Data is used exclusively for operational, analytical, or legal purposes within the context of the GoAlma platform.

c) Data minimization and accuracy: We process only the strictly necessary information, truthfully and updated.

d) Limited retention: Data is stored only for as long as necessary to fulfill the purposes of processing or legal obligations.

e) Security and confidentiality: We adopt robust technical and organizational measures to prevent unauthorized access, loss, or alteration of information.

5. Types of data processed

• Contact data: name, email, company, phoneUsage data: usage history, frequency, behavior analytics
• Uploaded documents: permissions, authorizations, evidence, environmental reports
• Technical data: IP, browser, system logs

GoAlma does not use the content uploaded by users to train external models nor does it share it with unauthorized third parties.

6. Information security

• We implement controls aligned with ISO/IEC 27001:Encryption in transit (TLS 1.2+) and at rest
• Strong authentication and access controlAudit logs and continuous monitoring
• Periodic vulnerability assessments
• Incident recovery procedures
• All infrastructure is hosted on cloud services that comply with international security certifications (ISO 27001, SOC 2, GDPR compliance).

7. User Rights

• Users can exercise at any time:
• Right of access to their data, Right of rectification or deletion
• Right to data portability
• Right to object to processing
• Right to be forgotten and to restrict processing

For residents of California or other U.S. states with specific privacy laws, GoAlma complies with the rights established in such regulations, including the right to opt out of sharing your data with third parties for commercial purposes. You can exercise these rights by writing to us at privacidad@goalma.ai.

8. Subprocessors and Third-Party Services

To ensure the secure, scalable, and efficient operation of our services, GoAlma uses external technology providers (“subprocessors”) who participate in data processing under strict confidentiality agreements and in accordance with applicable security and privacy standards.

The main subprocessors used by GoAlma include:

Amazon Web Services (AWS): Cloud server infrastructure where part of our platform is hosted, under ISO 27001, SOC 2 certifications, and GDPR compliance.

OpenAI (OpenAI, L.L.C.): Natural language processing engine used for automating document analysis. The processed data is used exclusively to perform functions requested by the user and is not used to train models.

Anthropic (PBC): Language model provider that enables complementary analysis in automated text comprehension tasks. Anthropic operates under principles of enhanced security, privacy by design, and compliance with GDPR.

Google Cloud Platform: Used for specific functions of storage, analytics, and security, in accordance with its regulatory compliance commitments.

Vercel Inc.:Deployment platform used for the GoAlma frontend, allowing for fast and secure delivery of our web interface. Vercel operates under modern security standards and aligns with regulations such as GDPR and SOC 2.

Supabase Inc.:Used as a real-time database and user authentication services. Supabase is built on PostgreSQL and adheres to good security practices, including encryption in transit and at rest, as well as compliance with international privacy regulations.

All subprocessors are subject to Data Processing Agreements (DPA) and comply with applicable data protection regulations, including the General Data Protection Regulation (GDPR).

No data is shared for advertising purposes or for the general training of models.

9. International TransfersGoAlma does not transfer data to third countries outside the European Economic Area without ensuring appropriate mechanisms under GDPR (Standard Contractual Clauses or others).

10. Update of this policyThis policy may be modified to adapt to regulatory changes, technical improvements, or new functionalities. Any updates will be visibly communicated on our website.

11. ContactIf you have questions about this policy or wish to exercise your rights as a data subject, contact us at: privacy@goalma.ai