Privacy and security
Last updated: November 10, 2026
How we look after your access
- Least privilege. We ask only for the permissions the job needs. An audit is done with a read-only account.
- A named account of our own. We work with an account you create for us in your Microsoft 365, protected with MFA. Never with an employee’s account.
- We do not keep your passwords. We do not ask for or store your users’ passwords. Temporary passwords are given by phone and not written down.
- Access with an end date. When a one-off job ends we tell you so you can remove the access. On a monthly plan, you can remove it whenever you want.
- Everything is recorded. Every change we make is logged and included in your report.
Who is responsible
Bluefaro IT is the trade name under which Esteban Barrientos provides IT support and Microsoft 365 administration services from Buenos Aires, Argentina. For any question about your data, write to [email protected].
What data we handle
- From people who contact us: name, email, company and what you tell us in your message.
- From our clients: billing and company contact details.
- From our clients’ users: name, work email, job title and the details needed to resolve each request (for example, onboarding or offboarding). This data belongs to the client and we handle it only on their instructions.
- From this site: we use no tracking cookies or analytics. Our hosting provider records basic technical data (such as IP address) to run and protect the site.
What we use it for
- Answering enquiries and preparing proposals.
- Delivering and documenting the contracted service.
- Invoicing and meeting legal and accounting duties.
We do not sell data or use it for advertising.
Who we share it with
Only the providers we need to operate: Microsoft (email and work tools) and Cloudflare (hosting for the site and the client portal). They may process data outside Argentina. We share data with no one else unless the law requires it.
How long we keep it
We keep work records and invoices for as long as the relationship lasts and for the time the law requires. Enquiries that do not become a service are deleted within 12 months.
Your rights
You can ask to access, correct or delete your data by writing to [email protected]. We reply within 10 business days.
If something goes wrong
If we detect a security incident affecting a client’s data, we tell them without delay, with what we know and the steps taken.
Changes
If we change this policy, we publish the new version on this page with its date.