Privacy policy

1. Data controller

Controller

Gonzalo Díaz-Heredero López

Tax identification number

[ENTER TAX ID BEFORE PUBLISHING]

Address for communications

Madrid (Spain)

Email

diazherederoconsultas@gmail.com

2. Data processed

The following data are processed through the contact form:

• full name;
• email address;
• telephone number, if the user chooses to provide it;
• requester profile and subject area of the matter;
• the description of the matter provided by the user;
• whether a deadline is pending and, if so, its expiry date;
• preferred format of the meeting.

The form does not accept attachments. Users are expressly asked not to include special categories of data (Article 9 GDPR) or unnecessary third-party information in the first contact.

The site uses no analytics, advertising or profiling cookies and embeds no third-party content. See the Cookie Policy.

3. Purposes

• to assess the request received and determine whether the matter can be handled;
• to reply to the communication and maintain the resulting professional correspondence;
• to manage, where applicable, the pre-contractual steps requested by the data subject.

4. Legal basis

Processing is based on pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR) and, where applicable, on the controller’s legitimate interest in responding to professional communications addressed to him (Article 6(1)(f) GDPR).

Providing the data marked as mandatory is necessary in order to assess and answer the request; without them the request cannot be handled.

5. Recipients and processors

The following technology providers process data on behalf of the controller:

• Formspree, Inc. — technical processing of contact form submissions.
• Cloudflare, Inc. — website hosting, content delivery network and technical access logs.
• Google LLC — email service used to receive and answer communications.

Data are not disclosed to any other third parties except where required by law.

6. International transfers

Some of the providers listed are established outside the European Economic Area or may process data outside it. In such cases, transfers rely on the mechanisms set out in Chapter V GDPR, in particular adequacy decisions or standard contractual clauses.

7. Retention periods

• Requests not accepted: retained for as long as necessary to answer them and thereafter for a maximum of twelve months from the last communication, unless a longer period applies by law.
• Requests giving rise to a professional relationship: retained for the duration of the relationship and thereafter for the applicable limitation periods.

8. Rights of the data subject

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability, and may withdraw consent where processing is based on it.

To do so, write to diazherederoconsultas@gmail.com with the subject line “Data protection”, providing proof of identity where necessary.

Data subjects may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Children’s data

This site and its contact channels are not directed at minors.

10. Automated decision-making

No automated decisions are taken and no profiling with legal effects on the data subject is carried out.

11. Confidentiality and security

Information received is treated confidentially. Reasonable technical and organisational measures are applied having regard to the state of the art and the nature of the data, including access restrictions and the use of encrypted channels.

12. Updates

This policy may be updated for legal, technical or operational reasons. The date of last review appears at the foot of this document.