Privacy
policy.
This English version is provided for information only. If there is any discrepancy between this version and the Spanish version, the Spanish version prevails.
Data controller
- Controller: Alejandro Arias Schintu
- NIF (Spanish tax ID): 71046186-Z
- Address: C/ Alquería Soria 32, puerta 2, 46470 Massanassa (Valencia), Spain
- Email: hola@alejandroschintu.com
- Telephone: 656 560 662
No Data Protection Officer has been appointed, as none of the circumstances that make such an appointment mandatory under Article 37 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), applies. For any question relating to this policy, you may write to the email address given above.
Purposes of the processing and legal basis
Each processing activity is set out below with its purpose and its legal basis. Each purpose relies on a single legal basis.
2.1. Appointment booking
Purpose: to schedule and manage meetings, consultations and quote requests through the booking system embedded in the website.
Legal basis: the taking of pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR). Bookings are made on the user’s initiative and with a view to a possible professional relationship, so no additional consent is obtained for this purpose.
2.2. Handling enquiries by email and WhatsApp
Purpose: to deal with enquiries and requests initiated by the user through the email link or the WhatsApp button and QR code provided on the website.
Legal basis: the taking of pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR) where the enquiry relates to the possible engagement of services. Where the enquiry has any other purpose, the processing is based on the controller’s legitimate interest in responding to the communications sent to him (Art. 6(1)(f) GDPR).
2.3. Loading of third-party services embedded in the website
Purpose: to enable the booking system to work and to display the reviews published on the controller’s Google profile. Both elements are embedded in the website, so when they load they transmit the user’s connection data to the relevant provider, including the user’s IP address and user agent, regardless of whether the user actually interacts with them.
Legal basis: the user’s consent (Art. 6(1)(a) GDPR), obtained through the settings panel for cookies and equivalent technologies, in accordance with Article 22(2) of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).
2.4. Web analytics
Purpose: to obtain aggregated statistical information on the use of the website by means of Google Analytics 4.
Legal basis: the user’s consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), obtained through the cookie settings panel. Analytics is not activated until the user gives consent.
2.5. Publication of client reviews
Purpose: to display on the website reviews of the controller’s services previously published by their authors on the controller’s Google profile.
Legal basis: the controller’s legitimate interest in promoting his professional activity and providing evidence of it (Art. 6(1)(f) GDPR). In this assessment it has been taken into account that the reviews were published by their authors on a publicly accessible profile intended for dissemination, that their content is not altered and that the impact on their authors’ privacy is limited. The user may object to this publication at any time, under the terms of section 7 of this policy, and the request will be complied with without the user having to give reasons for the objection.
The reviews are displayed exactly as they were published by their authors. Any person whose review is reproduced may request its removal from the website by writing to hola@alejandroschintu.com, without prejudice to the fact that deletion of the original review on Google must be requested from that platform.
2.6. Administrative, accounting and tax management
Purpose: issuing and keeping invoices and complying with the accounting and tax obligations arising from the relationship with clients.
Legal basis: compliance with a legal obligation to which the controller is subject (Art. 6(1)(c) GDPR).
No marketing communications are sent and there is no newsletter or mailing list.
Data processed
Only the data necessary for the channel used are processed:
- Appointment booking: name, email address, telephone number where the user provides it, time zone, and any information the user voluntarily includes when describing the reason for the meeting.
- Email and WhatsApp: the identification and contact data associated with the communication and any content the user chooses to include in their messages. In the case of WhatsApp, the user’s telephone number is visible to the controller owing to the way the service itself works.
- Embedded services and analytics: connection and browsing data, including the IP address and the identifier assigned by the analytics tool.
- Clients: in addition to the above, the identification and tax data needed for invoicing.
No special categories of data referred to in Article 9 GDPR are requested or processed.
Retention periods
Data are kept for the following periods, depending on their purpose:
- Enquiries and bookings that do not lead to a professional relationship: until the enquiry has been resolved and thereafter for a maximum of 30 days, after which they are erased.
- Data of clients with whom there is a professional relationship: for the duration of the relationship and, once it ends, blocked for the limitation period for personal actions arising from the contract, set at five years by Article 1964(2) of the Spanish Civil Code (Código Civil).
- Accounting and tax records: for six years from the last entry, in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio), a period that covers the four-year limitation period for the rights of the Tax Administration laid down in Article 66 of Law 58/2003 of 17 December, the General Tax Act (Ley General Tributaria).
Once the data are no longer needed for their purpose, and until any potential liabilities become time-barred, the data remain blocked under Article 32 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), available exclusively to judges, courts and the competent public authorities.
Once the applicable periods have ended, the data are securely erased.
Recipients of the data
Data are not disclosed to third parties except where required by law. The following providers are involved:
5.1. Processors
In order to provide the services properly and thereby improve the user experience, the following service providers are used:
- Sered — website hosting and email service. Servers located in Spain. You can read its privacy policy here.
- Cal.com, Inc. — booking management platform. United States. You can read its privacy policy here.
- Google Ireland Limited — web analytics service (Google Analytics 4). You can read its privacy policy here.
5.2. Third parties acting as independent controllers
The following providers determine, on their own account, the purposes and means of the processing of the data they collect:
- Meta Platforms Ireland Limited — WhatsApp messaging service, used when the user chooses to start a conversation through that channel.
- Google — in respect of the data it collects through the embedded element that displays the reviews published on its platform.
- International data transfers
The use of some of the services listed in the previous section involves the transfer of personal data to the United States.
These transfers are carried out on the basis of Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, in respect of providers that have joined that framework, or of standard contractual clauses adopted in accordance with Article 46 GDPR in respect of those that have not.
Please note that the adequacy decision referred to above is currently under review: it was upheld by the General Court of the European Union on 3 September 2025, but the appeal brought before the Court of Justice is still pending, and the European data protection authorities have asked the Commission to assess the impact of certain institutional changes that took place in the United States during 2026. The framework remains fully applicable for as long as the European Commission does not amend or suspend it. This policy will be updated if that situation changes.
The user may request further information on the applicable safeguards by writing to hola@alejandroschintu.com.
Rights of data subjects
Any user may exercise the following rights:
- Access to their personal data.
- Rectification of inaccurate data.
- Erasure of the data where any of the grounds laid down by law applies.
- Restriction of processing.
- Objection to processing, in particular where it is based on the controller’s legitimate interest.
- Portability of the data.
- Withdrawal of consent at any time, where the processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.
These rights, recognised in Articles 15 to 22 GDPR, may be exercised by sending an email to hola@alejandroschintu.com, stating the right to be exercised and attaching, where necessary to verify the identity of the requester, a copy of an identity document.
The user also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es), particularly where they have not obtained satisfaction in the exercise of their rights.
Automated decision-making and profiling
No decisions based solely on automated processing of data that produce legal effects concerning the user or similarly significantly affect them are taken, and no profiling is carried out for that purpose.
Security measures
The controller applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These include encryption of communications by means of an SSL/TLS certificate, control of access to systems and minimisation of the data collected.
Accuracy of the data
The user warrants that the data they provide are accurate and undertakes to notify any change to them. Use of the contact channels and the booking system is voluntary, although failure to provide the data requested may make it impossible to deal with the request or manage the booking.
Third-party links and platforms
The website links to the controller’s profiles on LinkedIn, Google and Instagram, and allows external applications such as the email client or WhatsApp to be opened. Interaction with those platforms is governed by their respective privacy policies, which are outside the controller’s control. Notwithstanding the above, any processing by the controller of data obtained through those platforms shall be governed by this policy.
Cookies and equivalent technologies
The use of cookies and equivalent tracking technologies, including those associated with web analytics and embedded third-party elements, is described in detail in the Cookie Policy, available at https://alejandroschintu.com/en/cookie-policy/.
Changes to this policy
The controller may amend this Privacy Policy to adapt it to legislative developments or to changes in the processing carried out. You are advised to consult it periodically.
Last updated: 3 September 2026