Privacy policy
Last updated 9 November 2026. This policy explains how we collect, use and protect personal data when you visit our website, contact us or use our services.
1. Who we are
Cinco De Mayo Technologies ("we", "us", "our") is a software development and IT solutions company operating the website cinco-demayo.com. For the personal data described in this policy, we act as the data controller. When we process personal data on behalf of clients inside the software we provide, we act as a data processor under a separate data processing agreement with each client.
You can contact us about privacy at any time using the contact form. Select "Something else" and start your message with "Privacy request".
2. The personal data we collect
Information you give us
- Enquiries: your name, work email, company name, company size, the topic of your enquiry and your message, when you use the contact form.
- Blog comments: your name, email address and comment. Your email address is never published.
- Business relationships: contact details and correspondence of client, supplier and partner representatives.
Information collected automatically
- Usage data: pages visited, time on page, referring website, approximate location derived from IP address, browser and device type, collected through Google Analytics 4 if you allow analytics.
- Security data: IP address and technical signals used by Google reCAPTCHA to protect our forms from spam and abuse, and server logs kept for security.
We do not intentionally collect special category data through the website and ask you not to include it in messages.
3. How and why we use personal data
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to enquiries and providing quotes | Enquiry data | Your consent and steps taken at your request before entering a contract |
| Publishing and moderating blog comments | Comment data | Consent |
| Delivering services to clients | Business contact data | Performance of a contract |
| Improving the website | Usage data | Consent (analytics cookies) or legitimate interests where permitted |
| Protecting forms and systems from abuse | Security data | Legitimate interests in keeping our services secure |
| Meeting legal obligations | Records as required | Legal obligation |
We do not sell personal data and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Sharing personal data
We share personal data only where necessary with:
- Service providers who host our website and email, provide analytics (Google Analytics) and spam protection (Google reCAPTCHA), under contracts that require them to protect the data.
- Professional advisers such as lawyers and auditors, under confidentiality obligations.
- Authorities where we are legally required to do so.
- A buyer or successor if our business is reorganised or sold, subject to this policy.
5. International transfers
Some service providers, including Google, may process data outside your country. Where this happens, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses or other mechanisms recognised by applicable data protection law.
6. How long we keep data
- Enquiries that do not lead to a contract: up to 24 months after our last contact.
- Client and supplier records: for the duration of the relationship and up to 6 years afterwards, or longer where law requires.
- Blog comments: for as long as the comment remains published, or until you ask us to remove it.
- Analytics data: according to the retention setting in Google Analytics, set to 14 months.
- Server and security logs: up to 12 months.
7. How we protect data
We use encryption in transit (HTTPS), access controls, secure hosting and staff confidentiality obligations to protect personal data. Read more on our security page.
8. Your rights
Depending on the law that applies to you, including the Nigeria Data Protection Act 2023 and the EU and UK GDPR, you may have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data;
- object to or restrict certain processing;
- withdraw consent at any time, without affecting earlier processing;
- receive your data in a portable format;
- complain to a data protection authority, such as the Nigeria Data Protection Commission or the authority in your country.
To exercise a right, send a request through the contact form. We may need to verify your identity, and we will respond within the time required by law.
9. Cookies
We use cookies and similar technologies as described in our cookie policy.
10. Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed. Significant changes will be highlighted on the website.