Privacy notice

This notice explains what data I hold, where it comes from, what I do with it and how to make me stop. It covers the emails I send to businesses, and this website, including its contact form.

Who is responsible

I am Cesar Castillo, an individual based in Italy. I decide how this data is used, so I am the data controller.

• Email: contact@cesarautomates.com, or reply to any email you received from me.

Which rules apply

• Because I am based in Italy, I follow the EU General Data Protection Regulation (GDPR). The supervisory authority is the Garante per la protezione dei dati personali.
• If your business is in the UK, this notice also gives you the information required by Articles 13 and 14 of the UK GDPR. The UK authority is the Information Commissioner's Office (ICO).
• If your business is in the US, my emails follow the CAN-SPAM Act: each one says who I am, gives my postal address and tells you how to opt out.

If I emailed your business

Where the data comes from:

• Google Maps business listings, collected through Apify.
• Your business's public website.
• For UK businesses, the Companies House register.

What I keep:

• Business details: name, website, category and city.
• The business contact email addresses published on your website.
• The result of checking whether those addresses can receive email.
• The emails I send you.
• The type of any reply you send (for example: unsubscribe, a complaint, a data request, a privacy question, or other). My database keeps only the type. The text of your reply stays in my automation software's logs for up to 7 days, then it is deleted.

Why I use it: to offer my service to your business by email and to follow up if you reply. Legal basis: Legitimate interests (Article 6(1)(f) GDPR / UK GDPR): offering a relevant service to businesses that may benefit from it. I keep a written assessment of this and you can ask for it.

If you do not want to hear from me

Reply to my email and say so, or use the unsubscribe option in it. I will not write to you again.

To make sure of that, I add your domain and a one-way hash (a fingerprint that cannot be turned back into the address) of your email address to a suppression list. I keep this list indefinitely, because it is the only way to guarantee that I do not write to you again.

If you contact me through this website

• Contact form. I receive what you type: your business name, website and industry, where your enquiries come in, how many you get per week, how quickly you usually reply, your biggest problem with enquiries, your budget and notes if you give them, and your name and email. I use it only to reply to you and, if you ask, to prepare our call. The form is processed by my automation software on my own server, whose logs keep it for up to 7 days. After that, form messages are kept for 12 months, unless we start working together. Legal basis: Taking steps at your request before entering into a contract (Article 6(1)(b)).
• Booking a call. The booking link takes you to Cal.com, a separate service with its own privacy policy. When you book, I receive the details you enter there. Legal basis: Taking steps at your request before entering into a contract (Article 6(1)(b)). Call bookings are kept for 12 months, unless we start working together.

Who else handles the data

Service providers that work on my behalf: my email provider, my server and database hosting, my automation software, a tool that collects business listings, an email-checking service, an email warm-up service (which has access to the mailbox I send from), a booking service and an AI provider that helps me draft emails and sort the replies I receive. Some of these providers are based outside the EU and the UK, for example in the United States. Where that happens, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses. If you want the full list of providers, ask me and I will send it.

How long I keep it

• Text of replies to my emails and of contact form messages, in my automation software's logs: up to 7 days.

Business details and records of the emails I send are deleted 24 months after our last contact. The suppression list is kept indefinitely, so I never contact you again. Form messages and call bookings are kept for 12 months, unless we start working together.

Automated decisions

I do not make decisions about you with legal or similarly significant effects by automated means.

Your rights

You can ask me to:

• tell you what data I hold about you and give you a copy;
• correct it;
• delete it;
• limit how I use it;
• stop using it to contact you. You can object to direct marketing at any time, and I will stop.

To do any of this, reply to the email you received or write to contact@cesarautomates.com. I will answer within one month, as the law requires.

You can also complain to the Garante per la protezione dei dati personali (Italy) or, if you are in the UK, to the ICO.

This website

This website sets no cookies. It has no analytics and no tracking, and it loads nothing from other websites: even the font is served from this site. This website keeps no access logs.

Changes

If this notice changes, the new version will be on this page with a new date.