Privacy Policy

This Privacy Policy explains how JEONJA TECHNOLOGY processes personal data across its digital channels, in line with applicable regulatory frameworks and internationally recognized best practices, including GDPR-inspired principles.

Privacy PolicySection 1GDPR-inspired

1. Introduction / Overview

This section outlines our commitment to privacy, identifies the entity responsible for processing personal data, and explains the legal and operational framework governing information handling across our digital channels.

Commitment to privacy

At JEONJA TECHNOLOGY, we recognize privacy as a fundamental value and an essential element of trust. We are committed to processing personal data in a responsible, transparent, and secure manner, applying privacy-by-design and data minimization principles across our platforms and services.

Our practices are designed to reduce risk, prevent unauthorized access or misuse, and ensure that personal information is handled exclusively for legitimate and clearly defined purposes.

Data controller

Legal name

JEONJA TECHNOLOGY

Trade name

JEONJA TECHNOLOGY

Role

Entity responsible for determining the purposes and means of personal data processing.

Legal and regulatory approach

Our primary jurisdiction of operation is Bolivia. We comply with applicable local laws and regulations governing privacy and personal data protection.

Additionally, we align our internal practices with internationally recognized privacy principles, including those reflected in the General Data Protection Regulation (GDPR), as a reference framework and best-practice guide, without implying formal regulatory applicability where it does not legally apply.

  • Lawfulness, fairness, and transparency
  • Purpose limitation and data minimization
  • Integrity, confidentiality, and accountability

Scope of this policy

This Privacy Policy applies to personal data processed through the following channels and activities:

Public website and informational pages

Contact and inquiry forms

Corporate and commercial communications

Related business and service operations

Privacy PolicySection 2Data Minimization

2. Personal Data We Collect

This section describes, in a transparent and specific manner, the categories of personal data that we may collect when you interact with our website, contact forms, or corporate communication channels.

Principle of data minimization

We collect only the personal data that is strictly necessary to fulfill the purposes explicitly described in this Privacy Policy. We do not request or process excessive, irrelevant, or disproportionate information.

This approach aligns with internationally recognized privacy principles, including data minimization and purpose limitation, without imposing obligations beyond those applicable under local law.

Categories of personal data

Identification data

  • First name
  • Last name

Contact data

  • Email address

Professional data (if applicable)

  • Company or organization name

Communications

  • Messages submitted through contact forms

Technical and usage metadata

In addition to the information you provide directly, certain limited technical data may be processed automatically to ensure the security, integrity, and proper functioning of our systems.

  • IP address (stored in anonymized or hashed form, where technically feasible)
  • Browser and device information (user-agent)
  • Date and time of submission (timestamp)

This metadata is not used for profiling or automated decision making and is processed solely for operational, security, and audit-related purposes.

Legal clarification

We do not knowingly collect sensitive personal data, special categories of data, or information unrelated to the purposes declared in this Privacy Policy.

If you choose to provide additional information voluntarily, such data will be treated in accordance with this Policy and applicable legal safeguards.

Privacy PolicySection 3Purpose Limitation

3. Purpose of Data Processing

This section explains the specific and legitimate purposes for which personal data is processed. Data is never used in a manner that is incompatible with these purposes.

Purpose limitation and lawful use

Personal data collected by JEONJA TECHNOLOGY is processed solely for explicit, legitimate, and clearly defined purposes. We do not process personal data in ways that are misleading, excessive, or incompatible with the original intent of collection.

This ensures responsible data handling and prevents unauthorized secondary use, profiling, or exploitation of personal information.

Legitimate processing purposes

Responding to inquiries

To review, respond to, and manage questions, requests, or communications submitted through our contact channels.

Commercial contact

To establish and maintain professional communication related to potential business relationships or service inquiries.

Project evaluation

To assess the feasibility, scope, and requirements of potential projects or collaborations requested by users.

Service and process improvement

To improve internal workflows, service quality, system reliability, and operational efficiency.

Explicit exclusions

Personal data is not used for automated decision-making, behavioral profiling, mass marketing, or advertising activities unrelated to a direct user request.

We do not sell, rent, or trade personal data under any circumstances.

Legal clarity

If personal data is required for a purpose not listed in this section, such processing will only occur after providing clear notice and, where appropriate, obtaining explicit consent or relying on a valid legal basis.

Privacy PolicySection 5Security Measures

5. Data Protection and Security Measures

This section describes the technical and organizational measures implemented to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures are designed to ensure confidentiality, integrity, and availability of information.

Security governance approach

JEONJA TECHNOLOGY applies a risk-based approach to data security. Safeguards are selected and implemented based on the nature of the data processed, potential impact, and operational context.

Security controls are reviewed periodically and adjusted as necessary to address emerging risks and operational changes.

Technical security measures

  • Encryption of data in transit and, where applicable, at rest using industry-accepted cryptographic standards.
  • Logical access controls, including authentication and authorization mechanisms, to restrict access to authorized personnel only.
  • Logging and monitoring of system activities to detect anomalous behavior and support incident investigation.
  • Secure configuration, regular updates, and vulnerability mitigation for systems and services.

Organizational and procedural measures

  • Defined roles and responsibilities for personnel handling personal data.
  • Internal policies and guidelines governing data access, processing, and confidentiality.
  • Awareness and training activities focused on data protection and secure information handling.
  • Incident response procedures to manage and mitigate potential security events.

Reference to recognized security standards

Our security practices are informed by widely recognized international standards and frameworks, such as ISO/IEC 27001 and general security principles derived from HIPAA.

These references are used as guidance only and do not imply formal certification, regulatory approval, or mandatory applicability.

Privacy PolicySection 6Data Retention

6. Data Retention Policy

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable legal, regulatory, or contractual obligations.

This section explains how long personal data may be retained and the safeguards applied to ensure that retention remains purpose-limited, proportionate, and compliant with applicable obligations.

Retention principle

We apply time-bound retention based on necessity, purpose, and applicable obligations. Retention is not indefinite and is continuously evaluated to reduce exposure and strengthen governance.

Practical statement

Personal data is retained only for the time required to provide the requested service or manage the business relationship, unless a longer retention period is required or permitted by applicable law.

Typical retention contexts

Retention periods may vary depending on the category of data and operational needs. Common contexts include:

Contact requests and business inquiries

Information submitted through contact forms (e.g., name, email, company, message) may be retained for a reasonable period to manage follow-ups, provide requested information, and maintain an internal record of communications.

Technical metadata and security logs

Technical metadata (e.g., timestamps, user-agent, and security-related logs) may be retained for operational security, troubleshooting, fraud prevention, and auditability, subject to proportionality and internal review.

Legal and compliance retention

Where required, we may retain certain data for longer periods to comply with applicable obligations (e.g., accounting, tax, or legal claims), and to establish, exercise, or defend legal rights.

Where local laws or formal agreements impose specific retention requirements, those provisions will prevail to the extent permitted by law.

Disposal, minimization, and access restriction

We aim to minimize retained data and reduce risk by limiting access and securely disposing of information when retention is no longer justified.

Deletion or anonymization

When retention is no longer necessary, data is deleted or anonymized using measures appropriate to the type of system and the sensitivity of the information.

Access restriction during retention

During retention, access is restricted to authorized personnel and limited to legitimate operational, legal, or security needs.

Periodic review

Retention practices are reviewed periodically to ensure the continued necessity and proportionality of stored information.