Privacy Policy

This policy covers our website, inquiries and consulting services. We act as controller for our own contacts, billing and business administration. When processing a client’s end-customer data under documented instructions, we act as processor and the client determines the purposes and lawful basis. Roles depend on the actual activity, not only the contract label.

Depending on your interaction, we receive names, email addresses, telephone numbers, company details, project scope, messages and consent records. Website and form security may involve IP addresses, timestamps, browser details and anti-spam metadata. Connected Meta services may supply messages or an app-scoped user ID, where used. Do not send passwords or sensitive personal data through public forms.

We use data to answer requests, assess projects, perform contracts, administer billing and meet legal obligations. Under the LGPD, relevant grounds include preliminary contractual procedures, contract performance, legal obligations and, following assessment of rights and necessity, legitimate interests in security and fraud prevention. Optional analytics and marketing requiring consent depend on your choice. Where Colombian law applies, we obtain prior, informed authorization unless a statutory exception applies; LGPD grounds do not replace that requirement.

The website stores your analytics choice in the browser. Google Analytics 4 loads only after consent. You can refuse optional analytics or change your choice through the website’s cookie preferences. Essential storage and security records support website operation. Google and other external resources receive the technical information needed to serve their requests; their own privacy terms also apply.

Hosting, email, CRM, analytics and communications providers may process the data necessary for their tasks. Access must be limited to the service purpose and applicable confidentiality and security obligations. We may also disclose information where legally required or necessary to establish or defend rights. We do not sell personal data.

Providers or client-selected tools may process data outside your country. Transfers must use a mechanism permitted by applicable law, including LGPD Article 33 and ANPD rules where relevant. Standard contractual clauses are one possible safeguard, not a claim that every provider already has a specific agreement in place. Contact us for information about recipients, destinations and safeguards applicable to your data.

Providing a phone number does not itself authorize marketing. Consent to promotional SMS is optional and is not a condition of purchasing consulting services. A phone number may be necessary when you specifically request contact through a mobile channel. We do not share mobile information, messaging opt-in records or consent with third parties or affiliates for their marketing or promotional use. Providers may process only what is needed to deliver messages, manage opt-outs and meet legal obligations, without independent marketing use. Message frequency varies; message and data rates may apply. Reply STOP, CANCEL, UNSUBSCRIBE or QUIT to stop messages, or HELP for assistance. You may also contact welcome@greenriver-etl.com or communicate your withdrawal by another reasonable means. We honor opt-outs and retain minimal suppression records to avoid contacting you again.

We keep data only as needed for the stated purpose, contract administration, applicable legal retention and the exercise of rights. Retention depends on the record and legal obligation; there is no single period for every category. Data no longer needed is deleted or anonymized. Restricted backups may persist until their normal replacement cycle and must not be reused for ordinary operations. Minimal consent, opt-out and request records may be retained where justified. The data-deletion page explains how to submit a request.

Subject to applicable law, you may request confirmation, access, correction, information about sharing, portability, anonymization, blocking or deletion, withdraw consent and challenge unlawful processing. Under the LGPD, simplified confirmation or access is provided immediately when possible, or a complete declaration within 15 days as Article 19 requires. Where Colombia’s Ley 1581 applies, consultations are answered within 10 business days, extendable by 5 with notice; claims within 15 business days from the day after receipt of a complete claim, extendable by 8 with notice. These are separate procedures, not a universal deletion deadline. You may petition the competent authority, including ANPD or Colombia’s SIC, subject to applicable procedures.

Email welcome@greenriver-etl.com with your request and the contact details you used with us. We may request proportionate identity verification, without unnecessary documents. Where a client controls the relevant data, we identify or forward the request to that controller as appropriate and assist under its instructions and applicable law. We explain any lawful retention or inability to act; a contract does not remove your statutory rights.

We apply reasonable safeguards proportionate to the service, including access restrictions and encrypted transmission where supported. Client accounts and credentials remain under client control; authorized access is limited to the agreed work and should end when no longer needed. No system is completely secure. We cooperate with clients and make incident communications required by applicable law, according to our role.

Effective October 24, 2026. Material changes will be communicated as required by law; a policy update does not replace consent where new consent is required. Privacy questions and requests: welcome@greenriver-etl.com.