1. Data controller
SummaQ ("SummaQ") is the controller of your personal data. Address: Tijuana, Baja California, México.
For any privacy matter, write to contacto@summaq.com or call +52 664 666 1038.
2. Personal data we collect
We collect only the data we need, depending on how you use the site:
- Contact form: name, email, phone (optional) and the content of your message.
- Course inquiries: name, email, phone (optional), the course you are interested in and your message.
- Resources tools and guides: calculations run in your browser and are not sent to our servers until you request a report. If you do, we receive your name, email, company, role and phone (the last three are optional), the tool's result summary (for example, scores per area or the cost breakdown you entered) and the version of the consent text you accepted.
- Newsletter: your name and email, only if you tick the subscription box.
- Follow-up emails about a result: if you tick the specific box for it, we store your email, name, the tool you used, the language and the schedule of the three follow-up emails. To be able to honor your unsubscribe we also keep an irreversible, hashed fingerprint of your email in a suppression list.
- Send to a colleague: if you choose to send the report to someone else, we receive that person's email and your name as the sender. You confirm you may share it; the colleague's email is used once for the send and is not stored (only a counter with a hashed fingerprint, for 24 hours, to prevent repeated sends).
- Internal request log: a short summary of each report requested (name, email, company, role, tool and summarized result) is kept for a short period so we can prepare an internal weekly digest for the SummaQ team.
- Technical and usage data: aggregated visit statistics through Vercel Analytics (cookieless, and without personally identifying visitors) and technical hosting logs (for example IP address, browser and request time). To limit abuse we keep temporary request counters tied to a hashed fingerprint of the IP address or email, which expire within 24 hours at most.
We do not ask for sensitive personal data. Please do not include it in your messages or in tool fields.
3. Purposes
Primary purposes (necessary)
- Reply to your message or request for a quote, proposal or information.
- Send you the report or guide you requested from Resources, as an attached PDF.
- If you decide so, send that report once to a colleague and tell them who sent it.
- Prepare an internal weekly digest of requests received so we can follow up promptly.
- Reasonable commercial follow-up on your request, including proposing a conversation with a consultant when you asked for one.
- Keep the site secure and prevent abuse or automated submissions.
Secondary purposes (optional)
- Send you news, articles and SummaQ content by email (only if you tick the subscription box).
- Send you three follow-up emails about the result of the tool you used (only if you tick the specific box; sent roughly 3, 7 and 14 days later).
- Produce internal statistics and improve our tools, using results without your name or email.
How to refuse secondary purposes
Leave the optional boxes unticked on our forms, or email contacto@summaq.com at any time and we will stop using your data for those purposes. Refusing does not affect how we handle your request. Every newsletter and follow-up email includes a one-step unsubscribe link.
4. ARCO rights and withdrawing consent
You may access your data, rectify it if inaccurate, cancel it or object to its use (ARCO rights), and withdraw any consent you gave us.
To exercise them, email contacto@summaq.com with:
- your name and a way to send you the answer;
- a document proving your identity (or your representative's);
- a clear description of the data and the right you want to exercise;
- anything that helps us locate your data (for example, the email you used on the site).
We will reply within the time limits set by law. Withdrawing consent may prevent us from continuing to handle certain requests.
5. Processors and transfers
To run the site we rely on providers that process data on our behalf and under our instructions:
- Resend (email delivery and subscriber list management).
- Vercel (site hosting, technical logs and cookieless usage statistics).
- Upstash (managed Redis database, purchased through the Vercel Marketplace), where the follow-up email schedule, the suppression list, the internal request log and anti-abuse counters are kept.
These providers may process data on servers located outside Mexico. We do not sell your data or share it with third parties for their own marketing. We will only disclose it without your consent in cases the law permits, for example in response to a request from a competent authority.
6. Retention
We keep your data only as long as needed for the purposes above:
- Contact and course inquiries: up to 24 months after the last communication.
- Resources report requests and their result summary: up to 24 months.
- Newsletter subscription: until you unsubscribe.
- Follow-up email schedule: until the last email is sent or you unsubscribe, and deleted at most 30 days afterwards.
- Internal request log for the weekly digest: 14 days.
- Suppression list (only the hashed fingerprint of the email): for as long as needed to honor your unsubscribe.
- Email of the colleague you send a report to: not stored.
- Anti-abuse counters (including a hashed fingerprint of the colleague's email, only to limit repeated sends): up to 24 hours.
- Technical logs: the period set by the hosting provider, normally short.
When these periods end we delete or anonymize the data, unless a legal obligation requires us to keep it longer.
7. Security measures
We apply reasonable administrative, technical and physical measures: encrypted connections (HTTPS), access limited to authorized staff, results calculated in your browser, limits on the data our forms accept and controls against automated submissions. No system is infallible; if a breach significantly affecting your rights occurs, we will tell you.
9. Minors
This site is aimed at professionals and organizations. We do not knowingly collect data from minors; if you believe we have, contact us and we will delete it.
10. Changes to this notice
We may update this notice. The current version is published on this page with its version number and date. If a change alters the purposes of processing, we will ask for your consent again where the law requires it.
11. Supervisory authority
If you believe your right to personal data protection has been violated, you may go to the Secretaría Anticorrupción y Buen Gobierno, the authority under the Federal Law on the Protection of Personal Data Held by Private Parties in force since March 2025. We would appreciate the chance to resolve your request first at contacto@summaq.com.
12. Short-form notice
SummaQ, located in Tijuana, Baja California, México, is the controller of your personal data. We will use it to handle your request and, only if you agree, to send you news or follow-up emails. You can exercise your ARCO rights and withdraw consent at contacto@summaq.com. See the full notice on this page.