⚖️ To be validated by our legal counsel (Kraemer & Kraemer) before any dispute. Drafted to GDPR (EU 2016/679) + Panamanian Law 81 of 2019 standards.
1. Data controller
The controller of your personal data is:
- LAS FUNDADORAS HERMANAS S.A. (“Inside Panama”)
- Panamanian corporation, RUC 155776412-2-2025, Public Registry Folio 155776412
- Registered office: PH Volcán Condo Village, Urbanización Volcán, Bugaba, Province of Chiriquí, Republic of Panama (Aviso de Operación N° 155776412-2-2025-2026-574435444)
- Data protection contact: legal@insidepanama.com
- Legal representative: Candice Martinez (publishing as Jade)
For any data-related question, write to legal@insidepanama.com. We reply within 48 business hours and process all GDPR requests within 30 days maximum.
2. Data we collect
We collect only the categories below, and only when necessary for service delivery.
2.1 Browsing data (analytics cookies, with consent)
- Anonymized IP address (last octet masked)
- Browser type, OS, screen resolution
- Pages visited, visit duration, traffic source
- Tool: Google Analytics 4 (anonymized IP, no Google Ads remarketing)
2.2 Newsletter data (explicit consent)
- Email address
- Signup date, signup source (page where you subscribed)
- Language preference (FR / EN / ES)
- Tool: Beehiiv (US-based, GDPR-compliant via SCC clauses)
2.3 Contact form data
- Name (first name only required)
- Message content
- Server-side metadata: IP, GeoIP country, user-agent (spam detection)
2.4 Consulting / digital product purchase data
If you purchase a consulting service or digital product:
- Full name
- Billing address
- Payment data: handled exclusively by Lemon Squeezy (PCI-DSS Level 1, Merchant of Record) or Gumroad. Inside Panama stores no card data.
2.5 Functional cookies (no consent required)
- Language preference (
localStorage) - Cookie banner state (
localStorage) - Article bookmarks (
localStorage, never transmitted) - None of these local stores are shared with third parties.
3. Purposes and legal bases (GDPR art. 6)
| Purpose | GDPR legal basis |
|---|---|
| Anonymous audience measurement | Consent (art. 6.1.a) |
| Newsletter delivery | Consent (art. 6.1.a) |
| Contact form responses | Pre-contractual measures (art. 6.1.b) |
| Consulting / product purchases | Contract execution (art. 6.1.b) |
| Affiliate links | Legitimate interest (art. 6.1.f) |
| Spam / fraud detection | Legitimate interest (art. 6.1.f) |
| Accounting & tax obligations | Legal obligation (art. 6.1.c) — Panamanian law |
4. Retention periods
| Category | Duration |
|---|---|
| Analytics cookies | 13 months max |
| Newsletter email | While subscribed; deleted within 30 days of unsubscribe |
| Contact form data | 24 months after last exchange |
| Purchase data (invoices) | 5 years (Panamanian accounting requirement) |
| Netlify server logs | 30 days |
| Sentry error logs | 90 days, no PII |
5. Your GDPR rights
Under Regulation (EU) 2016/679 and Panamanian Law 81 of 2019, you have:
- Right of access (art. 15) — get a copy of your data
- Right to rectification (art. 16) — correct inaccurate data
- Right to erasure / right to be forgotten (art. 17)
- Right to restriction of processing (art. 18)
- Right to data portability (art. 20)
- Right to object (art. 21) — to legitimate-interest-based processing
- Right to withdraw consent at any time
- Right to lodge a complaint with a supervisory authority (CNIL France, ANPD Panama, ICO UK, etc.)
To exercise these rights: write to legal@insidepanama.com with proof of identity (ID copy with sensitive numbers masked). Response guaranteed within 30 days.
6. Cookies and trackers
We use three categories of cookies. The consent banner (visible on first visit) lets you accept or refuse each.
6.1 Functional cookies (always on, exempt from consent)
| Cookie | Duration | Purpose |
|---|---|---|
i18nextLng |
Session | Remember your language |
cookieConsent |
13 months | Remember your cookie choice |
bookmarks |
Permanent | Your saved articles (never sent to server) |
6.2 Analytics cookies (with consent)
| Cookie | Duration | Purpose |
|---|---|---|
_ga |
13 months | Google Analytics 4 anonymous unique ID |
_ga_* |
13 months | GA4 session state |
_clck, _clsk |
1 year | Microsoft Clarity (anonymous heatmaps) |
6.3 Marketing / affiliate cookies (with consent)
No third-party cookies are dropped until you click an affiliate link (Skyscanner, Wise, SafetyWing, etc.). Cookies are then dropped directly by the partner under their own policy.
Reset your choices: open the console (F12) and type localStorage.clear(). The banner reappears on next visit.
7. Sub-processors (GDPR art. 28)
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Netlify Inc. | Web hosting | United States | DPA + SCC EU 2021/914 |
| Beehiiv Inc. | Newsletter | United States | DPA + SCC |
| Lemon Squeezy LLC | Payments (Merchant of Record) | United States | PCI-DSS Level 1 + SCC |
| Gumroad, Inc. | Digital products | United States | DPA + SCC |
| Google LLC (GA4) | Anonymous analytics | EU (data residency) | DPA + IP anonymization |
| Microsoft Corp. (Clarity) | Anonymous heatmaps | United States | DPA + SCC |
| Sentry | Anonymous error tracking | EU (Frankfurt) | DPA |
| Cloudflare Inc. | CDN, anti-DDoS | Global | DPA + SCC |
| ImprovMX | Email forwarding | EU (Belgium) | GDPR-native |
| Make.com | Internal automation | EU (Prague) | GDPR-native |
| Notion Labs Inc. | Internal storage | United States | DPA + SCC |
8. International transfers
Your data may be transferred outside the EU (mainly to the US). Such transfers are framed by:
- Standard Contractual Clauses of the European Commission (Decision 2021/914)
- The EU-US Data Privacy Framework for certified sub-processors
9. Security
- Site served over HTTPS (TLS 1.3) with HSTS preload
- Strict security headers: CSP, X-Frame-Options DENY, restrictive Permissions-Policy
- No password storage (we have no user accounts)
- At-rest encryption of databases at all sub-processors
- Automated security audits (Lighthouse CI on every deployment)
10. Minors
Inside Panama is not intended for users under 16. We do not knowingly collect minors’ data. If you are a parent and have noticed data collection on your child, write to legal@insidepanama.com for immediate deletion.
11. Complaints
In case of unresolved dispute with us, you can contact:
- CNIL (France): https://www.cnil.fr/en/plaintes
- ANPD Panamá: Autoridad Nacional de Transparencia y Acceso a la Información — https://www.antai.gob.pa
- Any other EU supervisory authority of your country of residence
12. Changes to this policy
This policy may be updated to reflect new legal obligations or services. The last update date appears at the top. Material changes will be notified by email if you are subscribed to the newsletter.