Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how Sidney Wuo Lopes, trading as Sidwuo Advisory, processes personal data collected through sidwuo.com and in connection with enquiries, qualification conversations, and advisory engagements.

Sidwuo provides independent executive advisory to help leadership teams make informed decisions about AI strategy, adoption, governance, and organisational change.

1. Who Is Responsible for Your Data?

1.1 Data controller

The controller of personal data collected through sidwuo.com and related business activities is:

Sidney Wuo Lopes
C/ Poeta Cabanyes, 60
08004 Barcelona, Spain

In this Policy, “Sidwuo,” “Sid Wuo,” “I,” “me,” and “my” refer to Sidney Wuo Lopes.

1.2 Privacy contact

For questions about this Policy or to exercise your rights, contact:

hello@sidwuo.com

1.3 Applicable framework

Personal data is processed in accordance with applicable data‑protection law, including where applicable:

• Regulation (EU) 2016/679, the General Data Protection Regulation.
• Spain’s Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights.
• Spain’s Law 34/2002 on Information Society Services and Electronic Commerce.
• Applicable rules on cookies and electronic communications.

2. Information Collected

2.1 Enquiries and service requests

When you contact Sidwuo or submit a service request, we may collect:

• Name.
• Business email.
• Organisation.
• Professional role.
• Country or region.
• Service or decision journey stage of interest.
• Strategic challenge and relevant timeline.
• Information you choose to provide about your organisation.

The contact form is intended for business and professional enquiries. Please do not include special‑category data, passwords, raw databases, or unnecessary confidential third‑party information.

2.2 Qualification calls

Qualification calls may be booked through a Google Calendar scheduling service. The scheduling provider may collect information such as:

• Name.
• Email address.
• Meeting date and time.
• Calendar and booking details.
• Information entered into the booking form.

The provider’s own privacy terms may also apply.

2.3 Advisory engagements

If you purchase or enter into an advisory engagement, we may process:

• Contact and professional information.
• Contract and statement‑of‑work details.
• Participant names and roles.
• Invoices and payment records.
• Information needed to prepare diagnostics, workshops, roadmaps, governance frameworks, or coaching.
• Business and organisational information provided by the Client.
• Communications relating to the engagement.

Client and board materials should be shared through the agreed engagement channels and are governed by the applicable contract, NDA, and data‑protection terms.

2.4 Payments

Payments may be processed by Stripe or another payment provider identified at checkout.

Sidwuo receives confirmation and billing information such as:

• Name.
• Billing email.
• Billing details.
• Amount paid.
• Transaction status.

Sidwuo does not receive or store full payment‑card numbers.

2.5 Website and device information

The website may process technical information such as:

• IP address in server and security logs.
• Browser and device type.
• Operating system.
• Pages visited.
• Referral source.
• Date and time of access.
• Basic diagnostic and security information.

2.6 Analytics

With your consent, Google Analytics 4 may process information about website use, including pages viewed, approximate location, browser and device information, and referral source.

Google Signals and Google advertising features are not used for this website unless this Policy is updated and the required consent is obtained.

2.7 Professional contact information

For legitimate business‑development purposes, Sidwuo may process professional contact information obtained from public professional sources, direct introductions, or business prospecting tools.

This may include:

• Name.
• Business email.
• Role.
• Organisation.
• Professional profile information.
• Communication preferences.

Where required, Sidwuo will provide information about the source of the data and will respect objections to further contact.

2.8 Cookies and similar technologies

The website may use:

• Strictly necessary cookies required for website operation and security.
• Preference cookies where applicable.
• Analytics cookies only with consent.
• Cookie‑management technologies to record your choices.

Further information is provided in the Cookie Settings interface.

3. Purposes and Legal Bases

Sidwuo uses personal data for the following purposes:

Purpose	Legal basis
Responding to enquiries and assessing whether a service or qualification conversation is appropriate	Steps taken at your request before entering into a contract
Scheduling qualification calls and advisory sessions	Pre‑contractual steps or performance of a contract
Delivering advisory, diagnostic, governance, capability‑building, and coaching services	Performance of a contract
Preparing and sending deliverables	Performance of a contract
Processing payments and maintaining financial records	Performance of a contract and compliance with legal obligations
Managing professional relationships and follow‑up	Legitimate interest, subject to applicable rules and your right to object
Sending newsletters or marketing communications	Consent where required, or another lawful basis where permitted
Understanding website use through analytics	Consent
Protecting the website, systems, and forms from fraud, spam, and abuse	Legitimate interest
Responding to legal, regulatory, tax, court, or law‑enforcement requirements	Legal obligation

Sidwuo does not sell personal data or share it for third‑party advertising.

4. Independent Advisory and Confidentiality

Sidwuo’s advisory model is independent and does not depend on selling software, receiving vendor commissions, or promoting specific implementation partners.

This does not mean that all information shared in a business enquiry is automatically covered by a formal NDA. Before sharing highly confidential board, commercial, employee, customer, technical, or regulatory material, please request or execute the appropriate confidentiality and engagement documentation.

Client engagement data is handled under the relevant agreement, NDA, and applicable data‑protection arrangements.

5. Cookies and Analytics

5.1 Necessary technologies

Necessary cookies or similar technologies may be used for website delivery, security, form handling, session management, and cookie‑preference storage.

5.2 Analytics consent

Google Analytics 4 is used only when you accept analytics cookies through the site’s consent‑management mechanism.

You can withdraw or change your consent at any time through Cookie Settings. Withdrawal does not affect processing carried out lawfully before withdrawal.

5.3 Google Fonts

If the website loads fonts from Google Fonts, your browser may connect to Google’s servers and disclose technical information such as IP address and browser details. Where technically feasible, fonts should be hosted locally to reduce external requests.

5.4 Retention

Analytics data is retained according to the configuration in force, which may be 2 or 14 months. Cookie choices are retained only as needed to remember your preferences.

6. Who Receives Personal Data?

Sidwuo may share personal data with service providers that support the advisory practice, including:

• Vercel: website hosting and delivery.
• GitHub: source‑code hosting; visitor data is not intended to be stored there.
• Formspree: contact‑form submission and email relay.
• Google Workspace: email, document storage, and calendar scheduling.
• Google Analytics: website analytics with consent.
• Google Fonts: font delivery if externally hosted.
• HubSpot: contact and relationship management, where used.
• Stripe: payment processing and billing.
• Apollo and Clay: professional contact prospecting and enrichment, where used.
• LinkedIn: professional networking and messaging where you interact with Sidwuo there.
• Substack: newsletters and publications where you subscribe or interact with content.

Some providers act as processors under Sidwuo’s instructions. Others may act as independent controllers under their own privacy policies.

Personal data may also be disclosed:

• When required by law.
• To courts, regulators, tax authorities, or law‑enforcement bodies.
• To professional advisors under confidentiality obligations.
• When necessary to protect the rights, security, or property of Sidwuo or others.
• Where you specifically ask or authorise Sidwuo to disclose it.

7. International Transfers

Some service providers may be located in, or process data from, countries outside the European Economic Area, including the United States.

Where required, Sidwuo relies on an applicable lawful transfer mechanism, such as:

• An adequacy decision.
• The EU–US Data Privacy Framework where the relevant provider is certified.
• Standard Contractual Clauses.
• Additional safeguards required by applicable law.

You may request further information about relevant transfer safeguards by contacting hello@sidwuo.com.

8. Security

Sidwuo applies technical and organisational measures appropriate to the risks associated with personal data, including where appropriate:

• HTTPS encryption.
• Two‑factor authentication for administrator accounts.
• Access controls.
• Encrypted devices.
• Restricted access to business systems.
• Secure handling of engagement documents.
• Backup and incident‑response procedures.
• Measures to detect and prevent spam, abuse, and unauthorised access.

No method of transmission or storage is completely secure. Sidwuo cannot guarantee absolute security.

Where a personal‑data breach triggers a legal notification obligation, Sidwuo will notify the relevant supervisory authority within the applicable period and affected individuals where required.

9. Client Engagement Data

9.1 Handling outside the public website

Confidential board and client materials are generally exchanged and stored outside the public website using agreed channels, such as email, Google Workspace, and secure document‑sharing tools.

9.2 Client instructions

The Client should identify any data‑protection restrictions, data‑classification rules, retention requirements, or security requirements that apply to materials shared for an engagement.

Where needed, the parties may agree additional security, confidentiality, retention, or processing terms.

9.3 No unnecessary sensitive data

Please do not send health information, biometric information, information about criminal convictions, children’s data, or other special‑category data unless it is necessary, lawful, and expressly agreed for the engagement.

10. Retention

Sidwuo retains personal data only for as long as reasonably necessary for the relevant purpose.

Typical retention considerations include:

• Enquiry data: while the conversation is active and for a reasonable period afterward.
• Contract and billing records: for periods required by Spanish tax, accounting, and commercial law.
• Engagement records: for the duration of the engagement and any period required to establish, exercise, or defend legal claims.
• Marketing records: until you unsubscribe or object, subject to applicable legal requirements.
• Analytics data: according to the analytics configuration described above.
• Cookie preferences: for the period necessary to remember your choice.

After the applicable period, data is deleted, anonymised, or securely destroyed where feasible.

11. Your Rights

Subject to applicable law, you may have the right to:

• Access personal data held about you.
• Correct inaccurate or incomplete data.
• Request deletion.
• Restrict processing.
• Object to processing based on legitimate interest.
• Object to direct marketing.
• Request portability of data you provided.
• Withdraw consent where processing is based on consent.
• Avoid a decision based solely on automated processing where applicable.

Sidwuo does not intend to make decisions about clients or prospects based solely on automated processing that produce legal or similarly significant effects.

12. How to Exercise Your Rights

Send a request to:

hello@sidwuo.com

Please provide enough information to help verify your identity and understand your request. Sidwuo may request additional information where reasonably necessary to prevent unauthorised disclosure.

Requests will be answered within the period required by applicable law, normally one month under the GDPR, subject to lawful extensions for complex or numerous requests.

You may also unsubscribe from marketing communications using the unsubscribe mechanism in the relevant message.

13. Right to Complain

You may lodge a complaint with the Spanish data‑protection authority:

Agencia Española de Protección de Datos (AEPD)
Website: aepd.es

You may also contact the supervisory authority in the EU country where you live, work, or believe an infringement occurred.

14. Business Audience

The website and Services are intended for businesses and professional users. They are not directed at children, and Sidwuo does not knowingly collect personal data from anyone under 16 through the website.

If you believe a child has provided personal data, please contact hello@sidwuo.com.

15. Changes to This Policy

Sidwuo may update this Privacy Policy when processing practices, service providers, technology, or applicable law changes.

The “Last updated” date identifies the current version. Material changes will be highlighted where appropriate.

16. Contact

Questions about this Privacy Policy or personal data may be sent to:

Sidney Wuo Lopes
C/ Poeta Cabanyes, 60
08004 Barcelona, Spain
Email: hello@sidwuo.com