Privacy policy
This is the privacy policy for the Kadabra IT website, in effect since August 30, 2026. Here's a plain-language rundown of what we collect when you visit this site or get in touch, what we use it for, who we share it with (almost no one), and what you can do if you ever want to see, correct, or delete what we hold on you.If anything here isn't clear, write to us at hello@kadabrait.net and we'll walk you through it.
What data we collect
The only personal data we actively collect is what you give us directly when you fill out a contact form at /en/contact or on another page of the site that has its own form. Depending on the page, that can include:NameEmail addressOrganization you're reaching out fromReason for your inquiry, chosen from a preset list that depends on the page (for example, "Canvas assessment," "accessibility," or "migration")The message you writeOn some forms, the URL of your current site or platform, when the page asks for it so we can take a lookAlongside those, we store two technical fields with every submission:A hash of your IP address — not the IP itself, but the result of running it through a salted cryptographic function, a one-way transformation that can't be reversed to recover the original IP. We use it solely to catch abuse and spam, never to identify you.The browser your device reports when you submit the form (commonly called the user agent).The form also carries two technical fields invisible to you — a bot-trap field and a submission timestamp — used only to filter automated spam. These aren't personal data.If you'd rather not leave any data in a form, you can reach out directly through the WhatsApp link on the site.
What we use it for, and on what legal basis
We use the data from the contact form for one purpose only: to respond to your inquiry and follow up commercially if that's warranted. We don't repurpose it beyond what prompted your contact in the first place.The legal basis for this depends on where things stand with you:When you submit the form, we process your data because you chose to give it to us for that purpose — that's your consent — combined with our legitimate interest in responding to business inquiries that come through the site.If the conversation turns into a client relationship, we process whatever data is needed to carry out the contract or the steps leading up to it, at your own request.Filling out the form is always optional. The only consequence of skipping a required field (name, email, or message) is that we won't be able to get back to you, since we'd have no way to reach you.The IP hash and reported browser are used strictly for security — to cut down on spam and abuse of the form — never to build a profile of you or for marketing.
Cookies and Similar Technologies
A cookie is a small file a website stores in your browser to remember something between visits. Not all of them ask the same thing of us: the ones strictly necessary for the site to work don't require your prior authorization, while anything else does, before it's ever switched on.We group this site's cookies into three categories:Necessary: needed for the site to function (for example, remembering your language choice or keeping the contact form submission secure). Always on, and never ask for prior consent, because without them the site couldn't provide the service you came for.Analytics: would measure how the site is used so we could improve it. We don't use any today — no Google Analytics, Google Tag Manager, or similar tool is installed.Advertising: would serve ads or measure campaigns. We don't use any of these either — no Meta Pixel, Hotjar, Clarity, or equivalent tool is installed.In plain terms: today this site runs on only what's strictly necessary to work. If we ever add analytics or advertising cookies, we'll ask before turning them on, make it just as easy to decline as to accept, and let you change your mind anytime from the site's cookie preferences panel. Accepting or rejecting non-essential cookies will never gate your access to the site's content.
Who we share data with
The data from the contact form is never shared with any external CRM or platform — we don't use Salesforce, HubSpot, Pipedrive, or anything similar. Leads are stored in the site's own database, and when someone at Kadabra needs to be notified of a new inquiry, we send that notification using Drupal's own built-in mail system, not an outside email marketing service.We do work with one external provider to host the site: Pantheon, whose infrastructure is located in the United States. That means an international transfer of data outside Uruguay, which we'd rather state plainly than leave out. The legal basis for that transfer is your own consent when you submit the form, together with the need to host the site in order to provide the service you asked for.Outside of these two cases — hosting and internal email notification — we don't share, sell, or hand your data to anyone else.
How long we keep it
Uruguay's data protection rules don't set a fixed number of years for keeping data: they say it should be kept only as long as it's needed for the purpose it was collected for, then deleted. To make that concrete instead of leaving it as an open-ended statement, Kadabra applies the following policy of its own:While your inquiry is active, or for as long as the business relationship lasts, we keep your data to follow up with you.If an inquiry doesn't progress, we keep the lead's data for up to 24 months from the last contact, and after that we delete or anonymize it.To be clear, this 24-month window is a Kadabra policy choice, meant to allow for a reasonable commercial follow-up period — it isn't a period the law requires. As noted above, your IP hash never stores the real address, so that particular field is already reduced to the bare minimum from the moment it's created.
Your rights: access, rectification and erasure
As the person the data belongs to, Uruguay's Law No. 18.331 on Personal Data Protection gives you these rights over data we hold:Access: ask us for everything we have on you, free of charge, up to once every six months. We have 5 business days to respond, in plain language.Rectification, update, completion, or deletion: ask us to correct, update, complete, or erase your data, also within 5 business days and at no cost.Challenging automated personal assessments: Kadabra doesn't make any automated decision about you without human review, but if we ever did, you'd have the right to know the criteria used and to challenge it.Beyond what Uruguayan law requires, and as our own added standard inspired by international frameworks like the EU's GDPR (to be clear: the GDPR doesn't govern Kadabra, since we don't offer services aimed at EU residents or monitor their behavior — we're adopting it only as good practice), we also recognize:Portability: ask us for your lead data in a file (CSV or JSON) so you can take it elsewhere.Restriction of processing: ask us to pause active use of your data while a complaint is being resolved, without requiring full deletion.For these last two, offered as an additional practice rather than a Uruguayan legal requirement, we commit to responding within 15 business days.To exercise any of these rights, write to hello@kadabrait.net. If we don't respond, or you're not satisfied with our answer, you can turn to Uruguay's Unidad Reguladora y de Control de Datos Personales (URCDP), the oversight authority created by Law No. 18.331, or file a habeas data action.
Contact for privacy enquiries
For any question about this policy or about your personal data, write to hello@kadabrait.net. It's the same address we use for everything at Kadabra, so mentioning "privacy" in the subject line is enough for us to route it quickly.This channel is separate from the business contact form at /en/contact — use this one when your question is specifically about privacy, not about a project or service.
Changes to this policy
This policy has been in effect since August 30, 2026. If we change it down the line, we'll do so by updating this same page with a new effective date, with no separate notices — so it's worth checking back if this matters to you.If a future change specifically affects the cookies section (for example, if we add analytics or advertising cookies), we'll ask for your consent again: we won't switch anything new on based on consent you gave under an earlier version of this policy.