Privacy notice

Chazut Foundation is responsible for the personal data described on this page (in Colombian law, it is the Responsable del Tratamiento).

• Location: Texas, United States
• Email: hola@chazut.org

The person who answers personal-data requests handles every petition, query and claim about personal data. You reach that person at hola@chazut.org.

We apply Colombian data-protection law (Ley 1581 de 2012 and its regulations) to the personal data described here, as this notice sets out. We do this for everyone who writes to us, wherever they live. We give an email contact only, with no postal address or telephone.

The open pages: the site's own code collects nothing that identifies you. Every page of this site is open to anyone, except the papers not yet published openly and their figures, which open only after a sign-in (section 3). You do not create an account or a password with us. The site has no analytics, and it shows no advertising. Nothing on the open pages sends what you type to us.

Display preferences, kept in your browser. The site remembers three choices: language, text size, and light or dark theme. Your browser keeps them on your device. The site never sends them to us. You can delete them at any time by clearing this site's data in your browser.

What the hosting provider receives. Like any website, this site reaches you through a hosting provider: the company that hosts this site and runs the sign-in to the papers. To deliver and protect the site, that company processes the technical data of each request, such as your IP address and the address of the page asked for. For the records of that data it makes available to us, it acts as our processor; for the rest, its own privacy policy applies. It keeps that data for as long as its own terms set; they state no fixed period. We have not turned on any record of individual page requests, and we keep none (the sign-in records of section 3 aside); we look only at totals, such as the number of requests and visitors and the countries they come from, which that company shows for at least the last 30 days. We do not use this data to identify or follow visitors.

Cookies. The site's own code sets no cookies. The sign-in to the papers uses a cookie that the company that hosts this site sets for an admitted reader who signs in, only to keep that reader signed in, for up to 24 hours, the session our sign-in is set to (section 3). That company may also set cookies of its own to deliver and protect the site.

Fonts. The fonts are served from this site's own address. Your browser does not contact any other service to show these pages.

"Do Not Track". This site does not track visitors across other sites, and it does not follow visitors over time on the open pages. A record of each completed sign-in is kept, only to give access to the unpublished papers (section 3). We change nothing when your browser sends a "Do Not Track" signal: on the open pages there is nothing to turn off, and the sign-in record is part of how the sign-in works.

Other parties. No other party collects personal data about your activity through this site, apart from the hosting provider as described above and in section 3.

Email. When you write to hola@chazut.org, we receive what you put in your message: your email address, your name if you give it, and anything else you write.

The Request-access form. On the Research page, the "Request access" form asks for a paper that is still in review. The form does not send anything to us. It opens your own email app with a message already written, addressed to hola@chazut.org. The message holds what you typed:

• your name and your email address (required);
• if you choose to give them: your institution or firm, your role and your phone number.

Nothing reaches us unless you send that message. Giving the optional details is up to you.

We do not ask for health, financial or other sensitive information. Please do not send it.

If you are admitted to read an unpublished paper. The papers not yet published openly, and their figures, open only after a sign-in. If we decide to give you access, we add the email address you gave us in your request to the list of readers allowed to sign in. Being on that list opens every paper behind the sign-in, not only the one you asked for. When you open one of these papers, the sign-in page asks for your email address. The sign-in page is served by the company that hosts this site, at that company's own web address. If the email address you type is on the list, that company emails you a one-time code, which expires after 10 minutes; you type the code in, and the paper opens. The sign-in page gives the same answer to every address typed, so nobody can learn from it who is on the list. After you sign in, a sign-in cookie keeps you signed in, for up to 24 hours, the session our sign-in is set to (see Cookies, in section 2).

This involves the following personal data:

• the list of admitted readers: your email address;
• a record of each completed sign-in, whether access was given or refused: the email address, the IP address, the country and the time, an identifier that company assigns to the reader, and other technical details of the sign-in;
• the email with your one-time code, sent to your address.

That company keeps the list and the records in our account with it, and sends the code, on our behalf (section 6). We can see the list and the records. We use them only to give you access. Because these records link an IP address to an email address, we treat them as personal data, like the rest of your details. How long the list and the records are kept is in section 8.

We use the personal data you send us, and the sign-in data of section 3, only to:

1. answer your message or your request;
2. if we admit you to read an unpublished paper, give you access to it through the sign-in described in section 3;
3. keep a record of what you asked, what we sent or gave you access to, and your authorization.

We do not sell or rent your data, and we share it only as section 6 describes. We do not add you to a mailing list. We do not use your data for advertising or fundraising. We will not use it for anything else without first asking for your authorization.

Except in the cases the law itself lists, Colombian law requires your prior, express and informed authorization, given in a way that can be checked later.

The message that the Request-access form writes for you ends with this sentence: "I authorize Chazut Foundation to use the details in this message to answer my request and to keep a record of it, and, if it admits me to read an unpublished paper, to add my email address to the list of readers who can sign in to the papers and to keep a record of each of my completed sign-ins, whether access was given or refused, as its privacy notice describes, including the processing of these details and records, on its behalf, by its email provider and by the company that hosts its site, in the United States and in other countries where they or their sub-processors operate." Sending the message is your authorization. The message itself is our record of it.

We keep proof that we gave you the information in Part B when we asked for your authorization, and we give you a copy of it if you ask.

If you write to us without using the form, we use your message only to answer you, and we keep the exchange as our record. If you ask in it to read an unpublished paper, we ask you for the authorization above before we add your address to the list of section 3. We add no address to that list without it.

Your message is stored by our email provider, the service that hosts our mailbox. It processes the data on our behalf, as a data processor (in Colombian law, an Encargado del Tratamiento), and may do so in the United States and in other countries where it or its sub-processors operate (section 7).

If we admit you to read an unpublished paper, the list of admitted readers, the sign-in records and the email with your one-time code are handled by the company that hosts this site and runs the sign-in to the papers. It too processes the data on our behalf, as a data processor (in Colombian law, an Encargado del Tratamiento), and may do so in the United States and in other countries where it or its sub-processors operate (section 7).

Within Chazut Foundation, only the person who runs it reads your message.

We do not give your data to anyone else, unless a law or a court order requires us to. If that happens, we will tell you, unless the law forbids it.

Chazut Foundation is located in the United States. If you write to us, or we admit you to read an unpublished paper, your data may be processed, on our behalf, by our email provider and by the company that hosts this site and runs the sign-in to the papers, in the United States and in other countries where they or their sub-processors operate. We tell you so here and in Part B; for a message sent through the Request-access form, the authorization sentence of section 5 covers this processing.

In its Circular Externa 005 de 2017, Colombia's data-protection authority, the Superintendencia de Industria y Comercio (SIC), listed the United States among the countries with an adequate level of data protection.

We keep a request, our reply and your authorization until we have answered the request, and for one year after that. Then we delete them. If we admit you to read an unpublished paper, we keep your authorization for as long as your address stays on the list, if that is longer. We delete them sooner if you ask, unless a law requires us to keep them.

If we admit you to read an unpublished paper, your email address stays on the list of admitted readers until the paper you asked to read is published openly (if you asked for more than one, until the last of them is); then we delete your address from the list. We delete it sooner if you ask us to, or if we decide to remove you. The company that hosts this site keeps the sign-in records in our account for a limited period; its plan currently states 24 hours.

We keep messages in a mailbox that needs a sign-in; only the person who runs Chazut Foundation can sign in to it. The list of admitted readers and the sign-in records are kept in our account with the company that hosts this site, which also needs a sign-in.

As the person the data is about (in Colombian law, the Titular), you have the right to:

• know what personal data we hold about you, and to update or correct it;
• ask for proof of your authorization;
• be told, on request, how we have used your data;
• withdraw your authorization, or ask us to delete your data. We will do it unless a law requires us to keep the data, and if so we will tell you which law;
• see your data free of charge;
• complain to the Superintendencia de Industria y Comercio (SIC) in Colombia, once you have completed the query or claim procedure with us (Ley 1581 de 2012, art. 16).

These rights come from Ley 1581 de 2012, art. 8, and the condition on a complaint from its art. 16. On withdrawal and deletion we give you more than art. 8 alone requires. We give these rights to everyone, wherever they live.

Write to hola@chazut.org. Tell us who you are, what you ask, and where we should send the answer. We may ask you to confirm that you are the person the data is about.

Queries (to know what data we hold and how we use it). We answer within 10 business days of receiving your query. If we cannot, we tell you why and the date on which we will answer, which is within 5 more business days.

Claims (to correct, update or delete data, or to report that we broke these rules or the duties of Colombian data-protection law). We answer within 15 business days, counted from the day after we receive your claim. If we cannot, we tell you why and the date on which we will answer, which is within 8 more business days.

• If your claim is missing something, we ask you within 5 days to complete it. If you do not complete it within 2 months of our request, we treat the claim as withdrawn.
• Within 2 business days of receiving your claim, we mark the data concerned "claim in process" (reclamo en trámite), with the reason for the claim, until we decide. We do not add this mark to the sign-in records, which the company that hosts this site keeps for a limited period (section 8); for those records, we note the claim in our record of your request instead.
• If a claim reaches us that we are not the right party to answer, we pass it on within 2 business days and tell you.

This site is written for engineers and researchers. It is not directed to children. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, write to hola@chazut.org and we will delete it.

If we change this notice, we post the new version here with a new date. If a change affects how we use data we already hold, we tell you by email before it applies, when we have your email address.

This policy is in force from the day it is first published on this site. The records it covers are kept for the period stated in section 8.

Chazut Foundation (hola@chazut.org) will use the details in this message only to answer your request, to let you sign in to read the papers if we admit you, and to keep a record of it. If we admit you, we add your email address to the list of readers who can sign in to the papers; being on the list opens every paper behind the sign-in, not only the one you asked for. The company that hosts this site then keeps for us a record of each completed sign-in, whether access was given or refused, with the email address, IP address, country and time, an identifier that company assigns to the reader, and other technical details of the sign-in, for a limited period (its plan currently states 24 hours), and sets a cookie that keeps you signed in, for up to 24 hours, the session our sign-in is set to. We keep your request until we have answered it, and for one year after that; your address stays on the list until the paper you asked to read is published openly, or until you ask us, or we decide, to remove it sooner. Our email provider and the company that hosts this site process these details and records on our behalf, and may do so in the United States and in other countries where they or their sub-processors operate. Only your name and your email address are required; the other details are up to you. We ask for no sensitive data and no data about anyone under 18. By writing to hola@chazut.org, you can see or correct your data, withdraw your authorization or ask us to delete your data, unless a law requires us to keep it, and use the other rights listed in section 10 of our full notice; once your query or claim to us has completed its procedure, you can complain to the Superintendencia de Industria y Comercio. Our full privacy notice, and any change to it, is on this site's privacy notice page. Nothing is sent until you send the message.