Privacy policy
Last updated: 30 September 2026. This is a translation; if there is any discrepancy, the Spanish version prevails.
In short: if you write to me, I use your data to reply and, if you ask, to call you. That’s it. I don’t sell it, share it or add you to any list.
1. Data controller
Owner: Luca Sanz Álvarez
NIF: 44444859G
Address: Castilla y León (España)
Email: sanzalvarezluca@gmail.com
Website: lucasanzalvarez.com
2. What data I process
- What you type in the form: name, email, company or website and phone (both optional), reason, message and, if you request a call, the day and time window you choose. Also whether you tick the optional box to receive news.
- Technical data: the page you write from, referring site and campaign parameters (UTM) if any, browser type and an irreversible fingerprint of your IP address (hashed with a secret key; the IP itself is not stored). Used to know where contacts come from and to stop mass submissions.
- Visit statistics: pages viewed, country, device type and referrer, aggregated and anonymous, without cookies (see the cookie policy).
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your message and, if requested, arranging and holding the call. | Steps taken at your request prior to entering into a contract (art. 6(1)(b)). For non-commercial enquiries (press, partnerships), my legitimate interest in replying (art. 6(1)(f)). |
| Protecting the form against spam and abuse. | Legitimate interest in website security (art. 6(1)(f)). |
| Understanding which pages and channels work, with aggregated data. | Legitimate interest in improving the website (art. 6(1)(f)), with no cookies or individual tracking. |
| Sending you news, only if you tick the optional box. | Your consent (art. 6(1)(a) GDPR and art. 21 LSSI-CE), which you may withdraw at any time by writing to me or from any message. |
No automated decisions or profiling. Marketing messages only if you opt in with the optional box.
4. Retention
Requests that do not lead to a project are automatically deleted 12 months after our last contact, including the copy in my inbox. If you opted in to news, I keep your name, email and company for that purpose until you withdraw consent. If we end up working together, the data becomes part of the professional relationship and is kept for its duration and then for the periods required by law.
5. Who else has access
I do not share your data with anyone, unless legally required. To run the website I use these processors, under data processing agreements compliant with article 28 GDPR:
| Provider | Purpose | Location / safeguards |
|---|---|---|
| Vercel Inc. | Website hosting, form delivery and cookie-free visit analytics. | Global network, headquartered in the US. EU-US Data Privacy Framework and Standard Contractual Clauses. |
| Supabase Inc. | Database where form requests are stored. | Servers in the European Union (Ireland). Standard Contractual Clauses for any access from outside the EU. |
| Google Ireland Ltd. (Gmail) | Receiving a notification of each request in my inbox. | EU, with possible access from the US. EU-US Data Privacy Framework and Standard Contractual Clauses. |
6. Transfers outside the EU
Some providers are US companies. Transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, otherwise, on the Commission’s Standard Contractual Clauses.
7. Your rights
You may request access, rectification, erasure, objection, restriction and portability at any time by writing to sanzalvarezluca@gmail.com. I will reply within one month and will only ask you to prove your identity if there is reasonable doubt. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local authority.
8. Children
This website is aimed at professionals and businesses. If you are under 14, please do not submit the form.
9. Security
HTTPS only, nothing stored in your browser, a database that is not publicly accessible, and access to requests limited to me. I only ask for the data needed to reply.
10. Changes
If anything relevant changes, I will update this page and the date above.
← Back