Your data,
plainly explained.

1. Who is responsible for your data

The data controller for any personal data processed through this website is:

For any question about this policy, the data we hold about you, or to exercise the rights described in section 7, write to [email protected]. We respond within 30 days as required by GDPR.

2. What we collect

We keep this list short on purpose. There are only three categories of personal data involved in this website:

• Information you send us by email. If you contact us at any of our published addresses ([email protected], [email protected], [email protected]), we receive whatever you choose to send — typically your name, email address, employer, and the contents of your message. Job applications may also include a CV.
• Anonymous usage analytics. We use Cloudflare Web Analytics, which is a cookieless, privacy-friendly analytics tool. It records aggregated page views, referrer URLs, and approximate location (country/region) from your IP address. It does not store your IP, does not set cookies, does not fingerprint your browser, and does not track you across sites.
• Technical cookies set by our hosting provider. Cloudflare, which hosts and protects this site, may set strictly necessary cookies (such as __cf_bm and cf_clearance) to mitigate bot traffic and abuse. These are required for the site to operate securely and are exempt from consent requirements under EU ePrivacy guidance.

3. Why we process it (lawful bases)

Under Article 6 of the GDPR, every category of processing must have a lawful basis. Ours:

• Email correspondence — lawful basis is either legitimate interest (Art. 6(1)(f)) in responding to your enquiry, or steps prior to entering into a contract (Art. 6(1)(b)) where you're asking about a possible engagement. Job applications are processed under your consent implied by sending us the application (Art. 6(1)(a)).
• Anonymous analytics — lawful basis is legitimate interest (Art. 6(1)(f)) in understanding aggregate traffic patterns. Because Cloudflare Web Analytics is cookieless and does not process identifiable personal data, no consent banner is required.
• Technical/security cookies — strictly necessary for the service you requested (loading the website), and therefore do not require consent under the ePrivacy Directive.

4. Cookies

This site does not use marketing, advertising, or tracking cookies. The only cookies that may be set are strictly necessary ones from Cloudflare for security and bot mitigation. You can block or delete these in your browser settings, though doing so may affect the site's ability to load.

5. Who else processes your data (sub-processors)

The only third party involved in handling data through this site is:

• Cloudflare, Inc. — hosting, CDN, DDoS protection, and analytics. Cloudflare may process data in the United States and other countries; transfers are governed by the European Commission's Standard Contractual Clauses (SCCs). See Cloudflare's privacy policy for details.

We do not sell your data, share it with advertisers, or transfer it to any party other than the sub-processor listed above. Emails you send us stay in our own mailboxes (Spainlink-controlled inbox).

6. How long we keep it

• Email correspondence: kept for as long as the conversation is professionally relevant, and then archived. We periodically delete inactive threads. If you ask us to delete your correspondence, we will (subject to any legal record-keeping obligations under Spanish tax or commercial law).
• Job applications and CVs: kept on file for up to 24 months from the date you sent them, then deleted, unless you explicitly ask us to keep them longer or to delete them sooner.
• Analytics data: retained by Cloudflare in aggregated form per their retention policy. We do not store identifiable analytics data ourselves.

7. Your rights

You have the following rights under the GDPR and Spain's LOPDGDD (Organic Law 3/2018):

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17, "right to be forgotten") — request deletion of your data.
• Restriction of processing (Art. 18) — ask us to pause processing while a dispute is resolved.
• Data portability (Art. 20) — receive your data in a structured, commonly used format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect processing already carried out.

To exercise any of these rights, email [email protected]. We will respond within one month. There is no charge for reasonable requests.

8. Filing a complaint

If you believe we have handled your data improperly and we have not resolved the issue to your satisfaction, you have the right to lodge a complaint with the Spanish data protection authority:

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Article 22 of the GDPR.

10. Changes to this policy

When this policy materially changes, we update the "Last updated" date at the top and (for substantive changes affecting how we process existing data) notify anyone with an active engagement by email. Previous versions are available on request.