Privacy notice

Itaca Technologies LLC is a technology architecture and implementation firm. We are the controller of the personal data described here.

This notice covers itacatech.com. It does not cover work we do under a signed client agreement, where the data terms of that agreement apply, and it does not cover our client portal, which has its own terms.

When you use the contact form, we receive your name, email address, company, role, phone number, the area you want help with, your timeline, which office you are writing to, the language you are reading in, and your message.

When you apply for a role, we receive your name, email address, phone number, your LinkedIn or portfolio links if you provide them, your message, and your CV file. We also record the date you accepted this notice.

When you load any page, our host records the request in a server log: your IP address, the page requested, the time, your browser and operating system, and the site you came from. This is standard web server behaviour and we do not connect it to form submissions.

When you submit a form, Cloudflare receives your IP address as part of the bot check described in section 5.

When you choose your cookie settings, we store the choice, the consent notice revision, and the time of the choice in one necessary first-party cookie. It stays on your device and is not sent to a consent-management provider.

If you accept analytics, Google Analytics receives the page URL and title, the site you arrived from, page, service and public job views, contact and application funnel steps, selected call-to-action and outbound-link clicks, approximate location, browser and device information, and identifiers held in the _ga cookies. Your IP address reaches Google at collection time and is discarded before it is logged.

What we never send to Analytics: your name, email address, phone number, company, role, message, CV, form values, or an Itaca account identifier. We do not fingerprint your browser or enable advertising features that follow you across unrelated websites.

We use Google Analytics 4 only after you accept analytics in the consent panel. We use basic consent mode: before that choice, the Google tag does not load and no measurement, identifier, or consent signal is sent to Google.

• records page, service and public job views, sessions, contact and application funnel steps, named calls to action, and outbound-link clicks
• labels these events only with controlled context such as site language, page type, service, public job reference, form type, or call-to-action name; it does not receive visible link text, query strings, or form values from us
• records the referring site, approximate country, region and city, browser, and device type
• uses the first-party cookies _ga and _ga_<container-id> to distinguish browsers and preserve session state
• uses your IP address at collection time to select a regional data centre and derive approximate location, then discards it before logging it
• receives no form values, user ID, or contact details from us
• runs without Google Signals, advertising personalisation, remarketing, or user-provided data collection

We use the measurements to answer questions such as which service pages get read and how many people who open a form finish it. We set user-level and event-level retention in Analytics to two months. Standard aggregated reports may remain available for longer because Google's retention control does not delete those totals.

Google Analytics is provided by Google LLC. Google collects measurements through regional data centres and may process them in the United States and other countries. Section 6 explains the transfer safeguards.

Your consent is the legal basis for storing analytics cookies and processing these measurements. You can reject or withdraw it without losing any site feature. There is more detail, including the cookie durations and browser controls, on the cookies and tracking page.

We do not sell your data, trade it, or share it for anyone else's marketing. We use service providers under contractual terms that govern what each may do with the data:

We disclose data beyond this only when the law requires it, or to establish or defend a legal claim. If that ever happens and we are permitted to tell you, we will.

Our hosting, storage, and email run in the United States. If you write to us from the European Economic Area, the United Kingdom, or Trinidad & Tobago, what you send us is transferred to the United States. We rely on the European Commission's standard contractual clauses with those providers, plus encryption in transit and at rest, to protect it, and you can ask us for the detail of those safeguards. Google collects Analytics measurements from European Economic Area and United Kingdom devices through regional servers before further processing. Its applicable data-protection terms provide the contractual safeguards for transfers outside those regions.

We keep what you send us for as long as it serves the purpose you sent it for, and for as long as the law requires us to keep it. In practice:

• an enquiry stays while the conversation is live, and afterwards as the context we would want if you came back to us
• an application stays while the role is open, and afterwards while you might be a fit for something similar
• server access logs are short-lived operational records, not a history of you
• the consent cookie expires after 182 days unless you clear it sooner
• Google Analytics cookies last for up to two years unless you withdraw consent or clear them sooner
• user-level and event-level Analytics data is set to a two-month retention period; standard aggregated reports may remain available for longer

We do not keep data because it might be useful one day. When it stops serving the purpose it was collected for, it goes.

You do not have to wait for us to reach that point. Ask us to delete anything we hold about you and we will, using the routes in section 9.

Wherever you are, you can ask us to:

• tell you what we hold about you and give you a copy
• correct anything that is wrong
• delete it
• stop processing it, or restrict how we do
• send it to you or another provider in a portable format
• object to processing we base on legitimate interest
• withdraw consent for analytics at any time from Cookie settings

If you are in the European Economic Area or the United Kingdom, these are your rights under Articles 15 to 22 of the GDPR, and you can complain to your national data protection authority. If you are in Trinidad & Tobago, the Data Protection Act, Chap. 22.04 applies. If you are in Florida, you have rights under the Florida Information Protection Act, Fla. Stat. 501.171, including notification if a breach affects your data.

We never charge for a request and we never make you give a reason. We do not use your data for automated decisions or profiling, so there is nothing to opt out of there.

To change or withdraw analytics consent, open Cookie settings in the site footer. The change applies immediately to future measurement.

Write to compliance@itacatech.com or call +1 786 568 8890. We answer within 30 days. If your request is complex we will tell you inside those 30 days and explain how much longer we need.

We will ask you to confirm your identity before we act on a request, because handing your data to the wrong person would be the worse failure. We only ask for as much as we need to be sure.

Data is encrypted in transit and at rest. Access is limited to the people who need it, and every account that can read an application or a CV requires multi-factor authentication. CVs are stored in a private bucket that is never publicly reachable, and the site itself has no credentials that can read it. We review access on a schedule.

We are a security firm, so we will say the honest thing: no set of controls removes risk entirely. If a breach affects your data we will notify you and the relevant authority within the deadlines the law sets, which is 72 hours under the GDPR.

This site is for people doing business with us, and we do not direct it at children. We do not knowingly collect data from anyone under 13, or under 16 in the European Economic Area where local law sets that age. If you believe a child has sent us data, write to compliance@itacatech.com and we will delete it.

Where we link out, those sites have their own privacy practices and we are not responsible for them.

If we change this notice and the change is material, we will say what changed rather than making you compare versions.