Snapshot 40832
Normalized text
Scripts and page chrome removed; this is what change detection compares.
NewsWhalemate is ISO/IEC 27001:2022 certifiedSee Trust Center Legal Privacy policy What personal data Whalemate processes, for what purpose, and what rights you have. Last updated: 2026-08-28. Model text pending legal review. Controller Whalemate processes personal data to operate the Human Risk Management platform and this site. The controller is identified in the DPA and in the site footer. Privacy contact: privacidad@whalemate.com. Data we process On the public site: name, work email, company, role, size and industry when you submit a demo, contact, partner or download form. On the platform (customers): name, work email, area, role, simulation results and training progress of employees the customer uploads or syncs. Purposes Responding to commercial and support requests. Operating the awareness program contracted by the customer (processor). Improving the product in aggregate. Meeting legal obligations. Processor for the customer When we process a customer's employee data, we do so on that customer's behalf. The processing agreement is in the DPA. No individual metric is used for disciplinary purposes by Whalemate. Retention and rights Site leads are kept for the commercial conversation and accounting obligations. On the platform, retention is described in the Trust Center. You may exercise access, rectification, erasure and objection by writing to privacidad@whalemate.com. International transfers Infrastructure runs on AWS, in the region the customer chooses when the contract provides for it. Subprocessors and change notice: see Trust Center and DPA. Public site versus platform Site leads (demo, contact, partner, application) are processed by Whalemate as controller. Employee data a customer uploads or syncs is processed as processor, under the DPA. Mixing those two bases is the error this paragraph avoids: a marketing form does not grant access to a tenant roster. Site processors Demo and application forms: Fillout. The contact form is our own: the data reaches our internal Slack. Measurement: Google Tag Manager when the container is published. Voice: ElevenLabs on the Fede widget, with its own terms. Internal email and CRM for the commercial follow-up you accepted. Cookie and script detail is in the cookie policy. The DPA covers the contracted platform, not every marketing cookie. Minors and data we do not ask for The site and the platform are not directed at minors. Do not type passwords, card data or identity documents in a form or in the voice assistant. If a field is not on the form, do not invent it in an attachment.