Privacy policy
ECAV Consultores E.A.S · RUC 80151197-6 · Concepción, Paraguay
Last updated: October 18, 2026
1. Data controller
The controller of the personal data described in this policy is ECAV Consultores E.A.S, RUC 80151197-6, with its registered address at Brasil y Pedro Juan Caballero, Concepción, Paraguay ("ECAV"). For any question or request about your personal data, the contact channel is administracion@ecav.com.py.
2. Scope
This policy describes which personal data the website ecav.com.py (the "Site") collects, for what purpose, for how long, and what rights people have. It applies to anyone who visits the Site, uses the contact form, uses the public RUC lookup tool, or contacts ECAV through the channels the Site lists.
It does not apply to the data that ECAV's customers enter into the systems they contract (ECAV ERP, ECAV SIFEN, ECAV Health, ECAV Edu and the other products, including the facturas.ecav.com.py portal). For that data, ECAV acts on behalf of the customer under the data protection clause of the Terms and conditions and, where applicable, the data processing agreement signed with each customer.
3. What data is collected and why
3.1. Contact form. The form on the /contacto page asks for a name, company or organization, email address, phone number, product of interest and a message. The name, email address and message are required; the rest is optional. When submitted, the Site creates a sales inquiry with that data in ECAV's customer relationship management (CRM) system, so that the sales team can reply, schedule a demo and prepare a quote. That data is used only to handle the inquiry, unless the person has ticked the news checkbox described in section 3.2.
3.2. Commercial news. The contact form includes an optional checkbox, unticked by default, to receive news from ECAV. Only those who tick it may receive commercial communications, and every message includes an unsubscribe link. Anyone who does not tick it receives no communication other than the reply to their inquiry. As of the date of this policy, ECAV does not send newsletters; if it starts doing so, it will send them only to people who ticked the box.
3.3. Commercial visitor tracking, only with consent. If the person accepts the optional cookies in the Site's consent bar, the Site records the commercial pages they visit (product pages, industries, pricing and contact). If they later submit the contact form, those visits are linked to their inquiry so that the sales team can serve them according to their interest. Without that consent nothing is recorded: not the pages visited, not the path, not the country of origin. Consent can be withdrawn at any time from the Site's cookie settings or by deleting the browser's cookies, and from that moment on no new visits are recorded. The technical details of this tracking are as follows:
Details of the cookies on ecav.com.py, all first-party:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
session_id | Browser session. The anonymous visitor identifier is derived from it, together with the IP address and the browser. | 7 days since the last visit (HttpOnly) | Essential |
frontend_lang | Remember the chosen language. | 1 year | Essential |
website_cookies_bar | Store the answer given in the cookie bar. | 999 days | Essential (stores your choice) |
odoo_utm_campaign, odoo_utm_source, odoo_utm_medium | Remember the source campaign when the link carries utm_* parameters. | 31 days | Optional (only with "Accept") |
There are no third-party cookies and no external analytics. There is no tracking cookie of our own: the visitor identifier is an irreversible hash of the IP address, the browser and the session, and the IP address is not stored.
What is stored, only if you accept cookies. Per visitor: an anonymous identifier, the site and the browsing language, the date of the first and last visit and the number of visits (country and time zone only if available; today they are not obtained). Per page view: which of the commercial pages it was, the full URL and the date and time. If you send the contact form, those visits are attached to your enquiry.
Retention. Anonymous visits are deleted 60 days after the last one, by a daily automatic Odoo task. Visits attached to an enquiry are kept with it, for at most 24 months when no contract followed; then they are deleted. Your cookie choice is remembered for up to 999 days.
3.4. Public RUC lookup. The /consulta-ruc page allows searching for a taxpayer by RUC number or by name. The text entered is sent to ECAV's server, which forwards it to an internal ECAV service; that service searches a copy of the public taxpayer registry published by Paraguay's Dirección Nacional de Ingresos Tributarios (DNIT) and returns the name or legal name, the check digit and the taxpayer's status. That data comes from a public source and is shown as it appears there. ECAV does not store the lookups performed nor link them to the person who performs them. The IP address from which the lookup is made is used only, in the server's memory and without being stored, to limit the number of lookups per minute and prevent bulk extraction of the registry. The tool is free and requires no sign-up.
3.5. Technical server logs. Like any web server, the Site's server records in its technical log files the IP address, date and time, requested page and browser type of each visit, in order to keep the Site secure and working and to diagnose failures. These logs are kept for 14 days and then deleted; they are not cross-referenced with the contact form data or with the commercial tracking described in section 3.3. The Site does not use third-party web analytics tools, advertising tracking tags or social media pixels.
3.6. Direct contact by WhatsApp, phone or email. The Site offers links to write to ECAV on WhatsApp (+595 971 578 513 and +34 623 96 64 24), to call by phone or to send an email to administracion@ecav.com.py or soporte@ecav.com.py. The data the person shares through those channels (phone number, name, content of the message) is used to handle the inquiry. WhatsApp is a service of Meta Platforms, which processes the communication data under its own privacy policy; ECAV does not control that processing.
3.7. Customer data. When an inquiry becomes a contract, ECAV processes the contact and billing data of the customer's representatives and users to manage the contractual relationship, electronic invoicing with the DNIT and support, under the Terms and conditions.
4. Cookies
The Site uses two first-party cookies that are necessary for it to work and do not require consent:
- session_id: identifies the browsing session on the server and protects forms against forged submissions. It is a technical cookie, not accessible from scripts (HttpOnly), with a lifetime of 7 days.
- frontend_lang: remembers the language chosen to display the Site (Spanish, English or Portuguese). It has a lifetime of 1 year.
In addition, the Site may use optional cookies for the commercial visitor tracking described in section 3.3, only if the person accepts them in the consent bar. Their names and lifetimes are detailed in that section. The Site does not use third-party analytics or advertising cookies.
Cookies can be blocked or deleted from the browser settings. If the technical cookies are blocked, the contact form and the language selection may stop working.
5. Third-party resources
The Site is served entirely from ECAV's servers, including its fonts, images and scripts. When a page loads, the person's browser does not request any resource from third-party servers, so no other company receives their IP address or browsing data as a result of visiting the Site.
6. Legal basis for processing
ECAV processes the data described in this policy on the following bases:
- Contact form and direct communications: the person's own request, as a step prior to a possible contract.
- Commercial news and commercial visitor tracking: the person's consent, which is optional and can be withdrawn at any time.
- RUC lookup: the data shown comes from a public source and is processed to provide the service the person requests; the temporary use of the IP address serves ECAV's legitimate interest in protecting the service against abuse.
- Technical logs and necessary cookies: ECAV's legitimate interest in the security and operation of the Site.
- Customer data: performance of the contract and compliance with legal obligations, in particular tax obligations.
7. Recipients, processors and data location
The Site and ECAV's customer relationship management system are hosted on Amazon Web Services (AWS), in the us-east-1 region (United States). AWS acts as an infrastructure provider on ECAV's behalf and does not access the data for its own purposes. The contact form data, the commercial tracking data and the technical logs are therefore stored outside Paraguay.
ECAV does not sell, rent or transfer personal data to third parties. It may disclose it only to providers that render technical services to it under contract (infrastructure, email) and to public authorities when a legal obligation so requires.
8. Retention
- Contact form inquiries that do not lead to a contract: 24 months from the last communication with the person; afterwards they are deleted.
- Consent for commercial news: until the person unsubscribes or withdraws consent.
- Commercial visitor tracking: the period stated in section 3.3.
- RUC lookups: not retained.
- Technical server logs: 14 days.
- Customer data: for the duration of the contract and, afterwards, for the retention periods required by the applicable tax and commercial legislation.
9. People's rights and how to exercise them
Anyone may ask ECAV for access to the personal data it processes about them, for its rectification when it is inaccurate or incomplete, for its erasure when it is no longer needed for the purpose for which it was collected, and may object to its processing, in addition to the other rights granted by the applicable data protection legislation. Anyone who has given consent for news or for commercial tracking may withdraw it at any time, without affecting the lawfulness of the prior processing.
Requests are sent to administracion@ecav.com.py, stating the name, the associated email address and the right being exercised; ECAV may ask for additional information to verify the identity of the requester. ECAV replies within 30 calendar days of receiving the request.
10. Visitors and customers in the European Union
If the person is located in the European Union, the processing of their data is also governed by the General Data Protection Regulation (GDPR). In that case, in addition to the rights in section 9, the person has the right to restriction of processing, to portability of the data they have provided, and to lodge a complaint with the supervisory authority of their country. The optional processing activities (commercial news and commercial visitor tracking) are carried out only with their consent, which they may withdraw at any time.
Storing the Site's data in the United States constitutes an international data transfer. ECAV relies for it on the safeguards that its infrastructure provider offers for transfers of personal data from the European Union, in accordance with the applicable legislation. The data of ECAV customers established in the European Union is processed in data centers located in the European Union, under the Terms and conditions.
11. Applicable law
ECAV's processing of personal data is governed by the personal data protection legislation of the Republic of Paraguay and by any other rules that apply according to where the person is located, including the GDPR for people located in the European Union.
12. Security
ECAV applies reasonable technical and organizational measures to protect personal data: the Site is served exclusively over encrypted connections (HTTPS), access to the customer relationship management system is restricted to authorized staff with individual credentials, and the infrastructure has periodic backups. No transmission over the internet is completely secure; ECAV cannot ensure absolute protection of the information, but undertakes to notify the affected people and the relevant authorities of security incidents affecting their data, when the applicable legislation so requires.
13. Minors
The Site and ECAV's services are aimed at companies, organizations and professionals. ECAV does not knowingly collect data from minors through the Site. If someone believes a minor has provided data through the Site, they can report it to administracion@ecav.com.py so that it is deleted.
14. Changes to this policy
ECAV may update this policy when the processing it carries out, the Site's tools or the applicable legislation change. The current version is published at ecav.com.py/privacidad with its last update date. If a change materially affects data already collected, ECAV notifies the affected people at the email address they provided.
15. Contact
- Controller: ECAV Consultores E.A.S · RUC 80151197-6
- Address: Brasil y Pedro Juan Caballero, Concepción, Paraguay
- Email for privacy matters: administracion@ecav.com.py
- Phone and WhatsApp: +595 971 578 513 · Europe: +34 623 96 64 24