Privacy Notice

Effective date:

1. Responsible party

Ruzaani is the brand under which Fernando Alberto Ocampo Romay provides AI and digital transformation consulting services and operates the website available at ruzaani.com, including its self-service assessments and related digital services.

For purposes of applicable data-protection law, Fernando Alberto Ocampo Romay is the person responsible for the processing of personal data described in this Privacy Notice. His domicile is Hidalgo 914, Coatzacoalcos, Veracruz 96400, Mexico.

Privacy inquiries and requests concerning personal data may be addressed to [email protected].

2. Scope

This Privacy Notice applies to personal data processed through the Ruzaani website, self-service assessments, saved assessments and reports, passwordless email sign-in, contact and inquiry functions, assessment reminders, marketing communications, communications with prospects and clients, and other interactions conducted through Ruzaani's digital services.

Where Ruzaani enters into a consulting engagement with a client, the applicable statement of work, engagement agreement, confidentiality agreement, or other written agreement may establish additional rules concerning information processed in connection with that engagement. To the extent such an agreement establishes specific obligations for the engagement, those obligations apply together with this Privacy Notice and prevail in relation to the matters they expressly govern.

3. Personal data processed by Ruzaani

Ordinary use of the website may generate technical and navigation information, including a random browser or session identifier, IP address where technically or operationally necessary, approximate country information supplied by infrastructure providers, language and locale, browser and device characteristics, requested route, timestamps, response information, security events, campaign or referral information, and privacy or tracking preferences.

The self-service assessments process the information supplied by the respondent about the organization, situation, practices, conditions, or other matters covered by the relevant assessment. They also process the assessment version, answers and selections, completion status, calculated results, confidence and coverage measures where applicable, and the resulting report.

An email address, name, or account is not required to complete a self-service assessment, view its immediate result, or obtain its immediate PDF report. Until assessment information is irreversibly disassociated, a random session identifier may nevertheless allow information belonging to the same assessment session to be linked together; such information is therefore treated as pseudonymous rather than represented as anonymous.

When a person chooses to save an assessment or report, Ruzaani also processes the email address used for passwordless email sign-in, an internal account identifier, authentication and session information, saved assessment information, saved reports, and the person's selected reminder and communication preferences.

When a person asks Ruzaani to make contact, Ruzaani may process that person's name, work email address, organization, role if provided, description of the situation or decision, preferred contact method, relevant timing, and subsequent correspondence. A request for contact authorizes Ruzaani to respond to that request; it does not constitute consent to receive marketing communications.

During an actual consulting engagement, Ruzaani may process professional contact details and business information supplied by the client or its authorized representatives where necessary to perform the agreed work. The processing of information specific to such an engagement may be further governed by the applicable engagement documents.

Ruzaani does not intentionally solicit sensitive personal data through its general website or self-service assessments. Visitors, prospects, and clients should not provide sensitive personal information, authentication credentials, secrets, unlawful material, or confidential information concerning third parties unless its disclosure is authorized and its processing is genuinely necessary for the relevant interaction or engagement. Where the processing of sensitive, financial, or patrimonial personal data requires specific consent under applicable law, Ruzaani will obtain that consent before carrying out the relevant processing.

4. Purposes of processing

Ruzaani processes personal data for purposes directly related to the interaction requested by the person concerned. These purposes include operating and securing the website; creating, saving, resuming, submitting, and retrieving self-service assessments; calculating assessment results; generating and delivering reports; providing passwordless email sign-in; maintaining saved assessments and account functions; sending assessment reminders when requested; responding to inquiries and contact requests; conducting communications relating to potential or existing engagements; performing agreed consulting work; maintaining records necessary for security, service integrity, legal compliance, and the establishment or defense of legal rights; and responding to requests concerning personal data.

Ruzaani also uses limited technical and event information to measure the performance and use of its website and digital services. Its first-party analytics are designed so that assessment answers, report narratives, email addresses, sensitive free text, client materials, and prospect communications are not included in ordinary navigation and product-event analytics.

Structured responses from self-service assessments may also be used to create disassociated datasets for Ruzaani's internal statistical analysis, research, improvement of its assessments and methods, and development of aggregate research findings. Direct account, email, and session identifiers are removed before information is used as a research dataset.

Ruzaani does not analyze or publish small cohorts where the available sample is insufficient for meaningful analysis or creates an unreasonable risk that an individual respondent or organization could be inferred. Any research published by Ruzaani from assessment responses is presented only in aggregate or otherwise disassociated form and does not contain individual responses or information intended to identify a respondent or organization.

Marketing is a separate and optional purpose. Ruzaani sends marketing communications only where the recipient has affirmatively chosen to receive them. Marketing consent is not required to use the website, complete an assessment, obtain a report, create or use an account, receive requested reminders, request report delivery, contact Ruzaani, or enter into a consulting engagement.

5. Limitation and revocation of consent

A person may at any time withdraw a marketing authorization, disable an optional communication preference, or request that Ruzaani limit a use or disclosure of personal data where applicable. Withdrawal of consent does not have retroactive effect and does not affect processing already lawfully carried out before the withdrawal.

Marketing communications provide a means to discontinue future marketing. Other requests to limit use or disclosure, or to revoke consent where processing depends upon it, may be submitted to [email protected]. The request must identify the person concerned and describe with reasonable clarity the processing or communication that the person wishes to limit or discontinue.

Disabling marketing does not delete saved assessments, reports, account information, or records relating to an existing engagement. Conversely, deleting an assessment or account does not by itself constitute consent withdrawal or modification for an unrelated purpose.

6. Analytics and advertising technologies

Ruzaani maintains a first-party analytics system for understanding meaningful navigation, assessment, and product activity. Assessment answers, assessment reports, email addresses, client materials, prospect communications, and sensitive free text are excluded from that system.

Ruzaani may also use Google Analytics, the LinkedIn Insight Tag, and the Meta Pixel for website measurement, audience analysis, and marketing attribution. These technologies are separate from the systems used to process assessment answers and consulting information. Ruzaani does not intentionally transmit assessment answers, report content, contact-form narratives, email addresses, account identifiers, client materials, or prospect communications to those services.

Google Analytics, the LinkedIn Insight Tag, and the Meta Pixel are disabled by default and are activated only after the visitor enables the corresponding optional analytics or advertising category through Ruzaani's privacy-preference mechanism. A person may subsequently change those preferences through the same mechanism. Additional information about these technologies and the storage they use is provided in the Cookie Notice.

Google Ads conversion tracking is not used as of the effective date of this Privacy Notice.

7. Service providers and international processing

Ruzaani uses service providers where necessary to operate its website and digital services. These currently include Google Cloud for infrastructure, Cloudflare for network delivery and security, and OpenRouter and approved model providers for AI functions where such functions are used. These providers may process information on Ruzaani's behalf only as required to provide the relevant technical function and subject to the applicable contractual, security, and data-protection controls.

Ruzaani's primary production infrastructure is located in the United States. Consequently, personal data may be processed outside Mexico. Other service providers may also process information in jurisdictions in which they operate. Ruzaani limits such processing to what is necessary for the corresponding service and requires appropriate protections from providers processing information on its behalf.

Google Analytics, LinkedIn, and Meta may receive limited website interaction information when their optional technologies are enabled. To the extent use of those technologies constitutes a transfer of personal data for which consent is required, consent is obtained through the applicable privacy-preference mechanism before the technology is activated.

Ruzaani does not sell personal data and does not provide assessment responses, client information, prospect information, reports, or communications to third parties for their own marketing, advertising, profiling, or commercial research.

Personal data may also be disclosed when required by applicable law, a valid order or resolution of a competent authority, or where disclosure is legally necessary for the recognition, exercise, or defense of a right.

8. Artificial intelligence processing

Ruzaani may use artificial intelligence for limited analytical, drafting, or explanatory functions. The scoring, thresholds, gates, routing rules, and required conclusions of Ruzaani's self-service assessments are deterministic and are not independently determined by an artificial-intelligence model.

Where assessment, prospect, client, or engagement information is processed through an AI service, Ruzaani uses OpenRouter and restricts processing to providers compatible with its data-handling requirements. AI processing is configured so that submitted content is not authorized for model training and is not retained by OpenRouter or the routed model provider as submitted prompt or response content after processing. Limited technical, security, billing, or legally required records may be maintained where they do not retain the substantive submitted content.

Only information necessary for the relevant AI-assisted function is submitted. Artificial intelligence does not replace accountable human review where a consulting conclusion requires professional or specialist judgment.

9. Retention and deletion

Ruzaani retains personal data only for the period required for the purpose for which it was collected, subject to any period of blocking or preservation required by applicable law or necessary for the establishment, exercise, or defense of legal rights.

A self-service assessment that has not been associated with a saved account is retained for no more than twenty-four hours after the last activity associated with that assessment. Once that period expires, the assessment record is deleted from the active system.

An incomplete assessment deliberately saved through an account is retained for ninety days after the last relevant activity. Where an email address is available, Ruzaani may send a transactional notice approximately seven days before its scheduled deletion. That notice concerns the requested saved assessment and is not a marketing communication.

A completed assessment and saved report associated with an account are retained for twenty-four months unless the person requests earlier deletion and no lawful reason requires temporary blocking or preservation.

When an applicable retention period ends, information linked to an identifiable person or account is deleted or, where Ruzaani retains information for legitimate statistical or research purposes, subjected to a process of disassociation that prevents it from being associated with the person concerned.

Requested assessment reminders may be sent approximately one day, three days, and seven days after the last interaction. They cease after completion, deletion, or the final reminder.

Marketing authorization expires after twelve months unless renewed. Ruzaani may retain the minimum record necessary to document a withdrawal or expiration and to prevent communications from being sent contrary to the person's expressed preference.

Where a contact request does not result in an engagement, the corresponding business-contact record is ordinarily retained for no more than twenty-four months after the last substantive communication. If an engagement begins, information relevant to that engagement becomes part of the corresponding business record and may be retained for the period required by the engagement, applicable law, accounting requirements, or the establishment, exercise, or defense of legal rights.

Pseudonymous first-party analytics events may be retained for up to twelve months. Information retained beyond that period for historical statistical purposes is aggregated or disassociated. Ordinary operational and security logs are generally retained for no more than thirty days. Particular records may be retained longer where reasonably necessary for an active security investigation, compliance obligation, or legal proceeding.

10. Security

Ruzaani maintains administrative, organizational, and technical safeguards appropriate to the nature of the information processed and the risks associated with the relevant system. These safeguards include controls relating to encrypted network transport, secure sessions, access restrictions, request validation, protection against unauthorized requests, security headers, abuse controls, credential management, and restricted infrastructure access.

No system connected to the Internet can guarantee absolute security. Ruzaani therefore treats security as an ongoing operational responsibility and adjusts its controls as systems, risks, and processing activities change.

If a security incident affecting personal data creates a notification obligation under applicable law, Ruzaani will provide the legally required notice to the affected persons.

11. Rights of access, rectification, cancellation, and opposition

The right of access permits the person to request confirmation of the personal data held by Ruzaani and information concerning its processing. The right of rectification permits the correction of inaccurate or incomplete data. The right of cancellation permits the person, where legally applicable, to request that personal data cease to be held following any legally required blocking period. The right of opposition permits the person, in the circumstances recognized by law, to object to specified processing.

Requests may be submitted to [email protected]. A request must state the name of the person concerned and a means by which the response may be communicated; provide information reasonably sufficient to verify the identity of the person or, where applicable, the identity and authority of a representative; identify the personal data concerned where necessary; state the right being exercised and the action requested; and provide any information reasonably useful for locating the relevant records.

Ruzaani will not routinely require government identification where identity can be established through a less intrusive and sufficiently reliable method, such as control of the email address associated with an account. Additional verification may be required where necessary to prevent disclosure, alteration, or deletion of another person's data.

Ruzaani will communicate its determination on a valid ARCO request within twenty business days from receipt. If the request is granted, it will be made effective within the following fifteen business days. Those periods may be extended once for an equivalent period where the circumstances permitted by applicable law justify the extension.

Where account controls provide a simpler mechanism for accessing, exporting, or deleting saved information, those controls may be used without limiting the right to submit a formal request.

12. Information concerning third parties

Any person who provides Ruzaani with personal, confidential, or proprietary information concerning another person or organization is responsible for having the right or authority necessary to provide that information.

The website and self-service assessments are designed to operate primarily with organizational and professional information. Respondents should avoid including unnecessary personal information about employees, customers, suppliers, or other persons. Where third-party information is genuinely necessary for a consulting engagement, its processing may also be governed by the terms of the applicable engagement.

13. Minors

Ruzaani's self-service assessments and account functions are intended for persons eighteen years of age or older and are not directed to minors.

If Ruzaani becomes aware that personal data relating to a minor has been retained through those functions, it will take reasonable steps to delete that information unless applicable law requires its temporary preservation.

14. Changes to this Privacy Notice

The Privacy Notice published at ruzaani.com/privacy/ is the current version and becomes effective on the date stated at the beginning of the notice. Changes to this Notice are communicated by publishing the revised version at that location together with its new effective date.

Ruzaani does not ordinarily send individual notices of revisions. If a change introduces a new purpose for processing existing personal data and applicable law requires renewed consent for that purpose, Ruzaani will obtain the required consent before applying the new purpose to the affected data.

Historical versions may be retained internally where necessary to establish the terms applicable to processing, consent, or acknowledgment at a particular time.

15. Language

Ruzaani may publish this Privacy Notice in more than one language. Where legally permissible, the English version governs the interpretation of this Privacy Notice in the event of an inconsistency between language versions, without limiting any mandatory rights that apply to the person concerned under applicable law.

16. Contact

Questions concerning this Privacy Notice, requests to exercise privacy rights, requests to limit the use or disclosure of personal data, and requests to revoke consent may be addressed to:

Ruzaani Operated by Fernando Alberto Ocampo Romay Hidalgo 914 Coatzacoalcos, Veracruz 96400 Mexico [email protected]