Privacy Policy

Narvaez Digital Marketing ("NDM," "we," "us," or "our") is a registered digital studio based in Washington State, United States. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit our website at narvaezcarlos.com or interact with our services.

We are committed to protecting your privacy and handling your data with transparency. This policy applies to all visitors, regardless of location, and addresses requirements under applicable laws including GDPR (EU), CCPA/CPRA (California), LFPDPPP (Mexico), and Washington State privacy regulations.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect the following categories of personal data:

• Contact form data: name, email address, company name (optional), selected service (optional), and message content — provided voluntarily when you submit our contact form.
• Analytics data: anonymized usage information such as pages visited, session duration, device type, browser, approximate geographic location, and referral source — collected via Google Analytics 4 through Google Tag Manager, only with your consent.
• Cookie preferences: your cookie consent choice, stored locally on your device.

We do not collect sensitive personal data, financial information, or data from minors.

3. How We Use Your Data

• Contact form submissions: to respond to your inquiry and initiate a potential business relationship. Legal basis: legitimate interest (responding to a direct request) and pre-contractual measures.
• Analytics: to understand how visitors use our website and improve the user experience. Legal basis: consent (opt-in via cookie banner).
• Essential cookies: to remember your theme preference (light/dark mode) and language selection. Legal basis: legitimate interest (site functionality).

4. Third-Party Processors

We share your data with the following service providers, solely for the purposes described above:

• Vercel Inc. — website hosting and delivery (San Francisco, CA, USA). Privacy Policy
• Google LLC — analytics via Google Analytics 4 and Google Tag Manager (USA). Privacy Policy
• Hostinger International Ltd. — email delivery for contact form submissions (Lithuania/USA). Privacy Policy

We do not sell, rent, or trade your personal data to any third party.

5. Cookies and Tracking Technologies

Our website uses the following types of cookies:

• Essential (no consent required): theme preference (localStorage), language preference, cookie consent status.
• Analytics (consent required):Google Analytics cookies (_ga, _ga_*) — used to measure site traffic and usage patterns. These are only activated if you click "Accept" on the cookie banner.

You can change your cookie preferences at any time using the "Cookie Settings" link in the website footer.

6. International Data Transfers

NDM is based in the United States. If you are visiting from the European Union, your data may be transferred to the United States for processing. We rely on the following mechanisms to ensure adequate protection:

• EU-U.S. Data Privacy Framework (for certified providers)
• Standard Contractual Clauses (SCCs) where applicable
• Processor agreements with all third-party providers

7. Data Retention

• Contact form data: retained in our email system for up to 24 months after the last interaction, or until you request deletion.
• Analytics data: retained by Google Analytics for 14 months (default GA4 setting), in anonymized/aggregated form.
• Cookie preferences: stored on your device until you clear your browser data or change your preferences.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data.
• Restriction: request that we limit the processing of your data.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: withdraw your consent for analytics cookies at any time via the cookie banner.

For EU residents: these rights are guaranteed under the GDPR (Articles 15–22). You also have the right to lodge a complaint with your local data protection authority.

For California residents: under the CCPA/CPRA, you have the right to know what data we collect, request deletion, and opt out of the sale of personal information. We do not sell your personal information.

For Mexico residents: under the LFPDPPP, you have ARCO rights (Access, Rectification, Cancellation, Opposition). This privacy policy serves as our Aviso de Privacidad.

To exercise any of these rights, contact us at hello@narvaezcarlos.com. We will respond within 30 days.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including HTTPS encryption, secure hosting on Vercel, access controls, and security headers. However, no method of transmission over the internet is 100% secure.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us: