Country-specific details (supervisory authority, timelines, filings) are on the Compliance page.
1. Who we are and what this policy covers
This policy explains how EBM CONSULTING S.A.C. (RUC 20557438191, Lima, Peru; hereinafter "EBM CONSULTING"), the company that operates nousengine.co and markets Nous, a Socosoft product, processes personal data:
a) of people who visit nousengine.co or write to us;
b) of contacts at customers, prospects who reach out to us, suppliers, and partners in our commercial relationships.
For this data, EBM CONSULTING is the data controller (in Peru, "titular del banco de datos" or "responsable").
This policy does not govern the data that our customers process with Nous. In that case, the customer is the controller, and our role depends on how Nous is deployed:
- On customer hardware or private cloud: Nous runs on infrastructure administered by the customer. EBM CONSULTING does not access that data unless the customer authorizes it for support, in which case we act as processor.
- As a managed service: EBM CONSULTING hosts and operates Nous on the customer’s behalf and acts as data processor under the data processing agreement (DPA) signed with the customer.
Customer model selection
In both cases, the customer decides which AI models Nous uses: models running within its own infrastructure or models from external providers that the customer authorizes. If the customer authorizes an external provider, the content Nous sends for processing goes to that provider and is governed by the customer’s agreement with that provider or by the DPA (see section 7).
2. What data we process and where it comes from
We do not request sensitive data through the Site. Please do not include it in the form.
| Category | Examples | Source |
|---|---|---|
| Professional identification and contact | name, work email, organization, role, phone | Contact form, email, meetings |
| Request content | the problem you want to solve, sector, constraints | Form and communications |
| Browsing data | IP address, cookie identifiers, pages viewed, device, browser, approximate country | Cookies and server logs (see Compliance › Cookies) |
| Contractual relationship data | billing contacts, signatories, administrator users | Customer or supplier |
| Commercial communications | subscription preferences, opens, unsubscribes | Your optional subscription |
See cookie details in Compliance › Cookies.
3. Purposes and legal bases
We do not sell your personal data. We do not "share" it for cross-context behavioral advertising within the meaning of California law.
We do not use Site data to make automated decisions that produce legal or similarly significant effects on you.
| Purpose | Legal basis (GDPR and equivalents) | Retention |
|---|---|---|
| Respond to your request and schedule a demo | Pre-contractual steps at your request (GDPR Art. 6.1.b) or legitimate interest in serving organizations that contact us (Art. 6.1.f); in Peru, Colombia, Ecuador, Chile, and Bolivia, your consent when submitting the form or the applicable pre-contractual exception | While we handle your inquiry and reasonable commercial follow-up |
| Manage relationships with customers, suppliers, and partners | Performance of a contract (6.1.b) and legal obligations (6.1.c) | For the duration of the contract plus applicable statutory tax and accounting periods |
| Send commercial updates about Nous | Consent (6.1.a) or, in the EU, legitimate interest for existing customers where communications law permits | Until you unsubscribe |
| Measure Site usage (analytics) | Consent via the cookie banner (Art. 6.1.a and Directive 2002/58/EC Art. 5.3) | According to each cookie’s lifetime (see Compliance › Cookies) |
| Site security and abuse prevention | Legitimate interest (6.1.f) | For the time necessary for the operational security of the Site |
| Comply with the law and defend legal claims | Legal obligation (6.1.c) and legitimate interest (6.1.f) | Applicable statute of limitations |
4. Who we share data with
- Service providers acting on our behalf (processors): Site hosting and infrastructure, transactional email, and analytics (Google Analytics, operated by Google LLC / Google Ireland Ltd., only if you accept analytics cookies). You can request current provider details at info@socosoft.com.
- AI model providers, only when authorized by a customer for its deployment: those enabled by the customer under its Agreement or DPA. The Site has no connected AI chat and does not send your contact details to model providers.
- Public authorities: when required by law or a valid binding order.
- Professional advisors (legal, accounting, auditors): under confidentiality obligations.
- Successors: in a merger, acquisition, or asset sale, with prior notice.
5. International transfers
EBM CONSULTING is based in Peru. Some service providers process data in other countries, such as the United States or the European Union. When data leaves the country where it was collected, we apply the safeguards required by the law of origin:
- From the EU/EEA: an European Commission adequacy decision (including the EU-U.S. Data Privacy Framework when the provider is certified) or the Standard Contractual Clauses of Decision (EU) 2021/914, together with a destination assessment.
- From Peru: transfer to a country with an adequate protection level or under contractual safeguards, pursuant to Article 15 of Law 29733 and its regulations.
- From Colombia: a country with an adequate protection level according to the SIC or an exception under Article 26 of Law 1581, and a data transmission agreement when the recipient acts as processor.
- From Ecuador: international transfer rules under the LOPDP (adequate destination, appropriate safeguards, or statutory exceptions).
- From Chile: rules under Law 19.628 and, upon entry into force, Law 21.719.
Copy of safeguards
You may request a copy of the applicable safeguards by writing to info@socosoft.com.
6. Retention
We keep personal data for the periods indicated in the table in section 3. Afterwards we delete or anonymize it, unless a law requires us to keep it longer.
7. Data processed in Nous on behalf of customers
When Nous runs as a managed service, we process each customer’s data according to its instructions and the DPA. That covers security measures, the list of sub-processors (including any model providers authorized by the customer), processing locations, incident notification, and data return or deletion at the end of the contract. If your data is processed by one of our customers, please direct your request to that customer; if you send it to us, we will forward it to them.
8. Security
We apply technical and organizational measures proportionate to the risk. If an incident affects your personal data, we will notify the competent authority and you within the timeframes required by applicable law (see the annexes in Compliance).
Measures described in Compliance › Security.
9. Your rights
You can request the following from us free of charge:
You may also withdraw your consent at any time without affecting prior processing, and request human review of any solely automated decision that significantly affects you.
How to submit a request. Email info@socosoft.com with the subject line "Data rights". State which right you are exercising and how to reach you. Where needed, we will ask to verify your identity. We will respond within the statutory timeframe of your country. If you are not satisfied, you may lodge a complaint with your national authority.
- Access. Know whether we process your data, which data, for what purpose, and who we share it with, and receive a copy.
- Rectification. Correct or update inaccurate or incomplete data.
- Erasure or cancellation. Have your data deleted when it is no longer needed, when you withdraw consent, or when it was processed without a legal basis, unless a law requires us to retain it.
- Objection. Ask us to stop processing your data, in particular for commercial communications or where processing is based on our legitimate interest.
- Restriction. Temporarily suspend the use of your data while we review a request, for instance if you contest its accuracy. In some countries this is called "blocking" or "suspension".
- Portability. Receive the data you provided in a structured, commonly used format, or have us transmit it to another organization where technically feasible.
The full procedure, statutory timeframes, and national authorities are listed in Compliance › How to exercise your rights and in annexes A–G.
10. Data protection inquiries and contact channel
We handle inquiries regarding personal data protection and communications with supervisory authorities at info@socosoft.com.
11. Children
The Site is intended for businesses and professionals. It is not directed at children and we do not knowingly collect data from anyone under 13 or under 18.
12. Changes
We will post any changes here. If a change is material, we will give notice on the Site or by email to those with an active relationship with us.
13. Contact
Privacy: info@socosoft.com · Location: Lima, Peru.
Country and regional details (annexes A–G): Compliance page.