Privacy Policy

1. Data controller

2. Applicable legislation

This privacy policy has been drawn up in accordance with the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, GDPR).
• Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
• Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

3. Personal data we collect

Depending on how you interact with the website, we may process the following categories of personal data:

• Identification data: first name, surname(s) and company or organisation.
• Contact details: email address and telephone number.
• Browsing data: IP address, browser type, operating system, pages visited, time spent on the website and other data collected through analytics cookies.
• Data provided voluntarily: any information you provide through the contact form or other means of communication on the website.

4. Purposes of processing

Users' personal data is processed for the following purposes:

4.1. Handling enquiries and contact requests

Dealing with and replying to enquiries, requests for information or collaboration proposals sent via the contact form or by email. This includes handling requests relating to talks, training and consulting services.

4.2. Website analysis and improvement

Analysing users' browsing behaviour using web analytics tools in order to improve the user experience, the structure of the website and the quality of the content offered.

4.3. Compliance with legal obligations

Processing data where necessary to comply with a legal obligation applicable to the data controller.

4.4. Sending communications (where applicable)

If you have given your express consent, we may send you commercial or informational communications relating to Dr. Alex Romaní's consulting, training and speaking services. You may withdraw this consent at any time.

5. Legal basis for processing

The processing of users' personal data is based on the following legal grounds, in accordance with Article 6 of the GDPR:

• Consent of the data subject (Art. 6(1)(a) GDPR): for sending commercial communications and for placing analytics and third-party cookies.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): for handling requests for professional services (talks, training, consultancy).
• Legitimate interest of the data controller (Art. 6(1)(f) GDPR): for the proper functioning and security of the website, as well as for the internal analysis of browsing data.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR): where processing is necessary to comply with current legislation.

6. Contact form

The website has a contact form intended to facilitate communication between users and the data controller. By submitting the form, you consent to the processing of the data you provide in order to deal with your request.

The data provided through the contact form is:

• First name and surname(s)
• Email address
• Subject and content of the message

This data is processed solely for the purpose of handling your enquiry and is kept for as long as necessary to deal with it, and thereafter for the applicable statutory limitation periods.

7. Data retention periods

Personal data will be kept for as long as strictly necessary to fulfil the purpose for which it was collected, and thereafter for the applicable statutory limitation periods:

• Contact details and enquiries: kept for the duration of the professional or commercial relationship and, once it has ended, for a maximum period of 3 years for the purposes of any legal liability arising from the processing.
• Billing and contract data: kept for 6 years in accordance with Article 30 of the Spanish Commercial Code.
• Browsing and analytics data: kept for the period indicated in our Cookie Policy.
• Data for commercial communications: kept until you withdraw your consent.

Once these periods have elapsed, the data will be deleted or, where applicable, irreversibly anonymised.

8. Data recipients

Users' personal data will not be disclosed to third parties unless required by law. However, in order to provide certain services, the following service providers (data processors) need access to the data:

8.1. Google Analytics (Google LLC)

A web analytics service that collects information about browsing on the website. Google may transfer data to servers located in the United States under the EU-U.S. Data Privacy Framework. More information is available in the Google Privacy Policy.

8.2. Google Fonts (Google LLC)

A web font service that may record the user's IP address when loading fonts. More information is available in the Google Fonts privacy FAQ.

8.3. YouTube (Google LLC)

The website may include embedded YouTube videos. When you play a video, YouTube may set cookies and collect user data in accordance with its own privacy policy. More information is available in the Google Privacy Policy.

8.4. Web hosting provider

The website is hosted on servers whose provider acts as a data processor, with access only to the data strictly necessary to provide the hosting service. This provider has signed the corresponding data processing agreement in accordance with Article 28 of the GDPR.

8.5. WordPress

The website is built on WordPress, a content management system that may store technical session and configuration data. More information is available in the Automattic Privacy Policy.

9. International data transfers

Some of the service providers mentioned above (Google LLC / Alphabet Inc.) may process data on servers located outside the European Economic Area, specifically in the United States. These transfers are carried out on the basis of the following safeguards:

• Participation in the EU-U.S. Data Privacy Framework (DPF), under the European Commission's adequacy decision.
• Failing that, through the adoption of standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

10. Users' rights

In accordance with the GDPR and the LOPDGDD, you may exercise the following rights at any time:

• Right of access (Art. 15 GDPR): to obtain confirmation as to whether or not your personal data is being processed and, if so, to access it.
• Right to rectification (Art. 16 GDPR): to request the correction of any data that is inaccurate or incomplete.
• Right to erasure (Art. 17 GDPR): to request the deletion of your personal data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18 GDPR): to request that the processing of your data be restricted in certain circumstances.
• Right to data portability (Art. 20 GDPR): to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another data controller.
• Right to object (Art. 21 GDPR): to object to the processing of your personal data where the legal basis is the legitimate interest of the data controller.
• Right not to be subject to automated decision-making (Art. 22 GDPR): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, you can send a request by email to alex.romani.rivera@gmail.com, stating the right you wish to exercise and enclosing a copy of a document proving your identity (national identity card, NIE or passport).

The data controller will respond within a maximum of one month of receiving the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case you will be informed within the first month.

11. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data infringes current legislation, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

12. Security measures

The data controller has adopted the technical and organisational measures necessary to guarantee the security of personal data and prevent its alteration, loss, or unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed, in accordance with Article 32 of the GDPR.

The measures adopted include:

• Encryption of communications using an SSL/TLS certificate (HTTPS protocol).
• Restricted access control to information systems.
• Regular backups.
• Regular updating of software and content management systems.

13. Changes to the privacy policy

The data controller reserves the right to amend this privacy policy to adapt it to new legislation or case law, as well as to industry practice. If significant changes are made, users will be informed through the website.

We recommend that you review this policy regularly to stay informed about how your personal data is protected.

Last updated: April 2026