Legal

Privacy Policy

Last updated: August 6, 2026

1. Data controller

Yonathan Coran Rivas
NIE: Y-6439255-M
Address: Paseo de la Castellana, 93B, Madrid, Spain
Email: responsable@yonathanrivas.com
Phone: +34 910 052 829

2. Purpose and legal basis of processing

We process your personal data for a specific purpose, with a single legal basis per purpose:

  • Managing inquiries and requests for information (WhatsApp, email or phone): legal basis — pre-contractual measures at the data subject's request (art. 6.1.b GDPR).
  • Managing the business relationship (contracted services, invoicing): legal basis — performance of a contract (art. 6.1.b GDPR).
  • Sending commercial communications: legal basis — prior consent of the data subject (art. 6.1.a GDPR), revocable at any time.
  • Compliance with tax, accounting and legal obligations: legal basis — compliance with a legal obligation (art. 6.1.c GDPR).

3. Data retention period

Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected and to determine any liability that may arise from that purpose and the processing of the data.

  • Inquiries that do not result in a contractual relationship: retained for up to 12 months from the last contact, unless you request earlier deletion.
  • Client data: retained during the business relationship and for the periods established by tax and accounting legislation (generally 5-10 years).

4. Data recipients

Your data will not be shared with third parties, except where legally required or necessary for the provision of the service (for example, financial institutions for payment management, tax or labor advisory, technology service providers such as hosting, email marketing, etc.). In all cases, data processing agreements are established in accordance with the GDPR.

Hosting provider: to provide certain services we use technology providers that may access personal data on behalf of the controller. These include Namecheap, Inc., our infrastructure and hosting provider. In processing carried out on behalf of the controller, Namecheap acts as a data processor under its Data Processing Addendum (DPA), which allows for authorized sub-processors.

5. WhatsApp as a contact channel

The main contact channel for this site is WhatsApp. To manage communications with users, we use WhatsApp services and, where applicable, Meta's business tools. In processing where Meta processes personal data on behalf of the controller, Meta's data processing terms and the contractually established international transfer mechanisms apply, including the European Data Transfer Addendum and the Standard Contractual Clauses approved by the European Commission, when applicable.

6. International transfers

Certain technology providers may process data outside the European Economic Area. In the case of Namecheap, its Data Processing Addendum provides for data transfers to the United States and establishes the application of the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914, Module 2: Controller to Processor), when applicable. When transfers occur within the framework of Meta or WhatsApp services, the mechanisms provided for in their contractual terms apply, including the Standard Contractual Clauses and the corresponding data transfer addenda, when applicable. When managing a project with international clients involves transferring personal data outside the European Economic Area, the safeguards provided for in the GDPR also apply.

7. Rights of data subjects

In accordance with the GDPR and the LOPDGDD, you may exercise the following rights:

  • Right of access: Know what personal data we process.
  • Right of rectification: Request correction of inaccurate or incomplete data.
  • Right of erasure: Request deletion of your data when no longer necessary.
  • Right to object: Object to the processing of your data for direct marketing purposes.
  • Right to restriction: Request restriction of processing in certain cases.
  • Right to data portability: Receive your data in a structured format and transmit it to another controller.
  • Right not to be subject to automated decisions: Not to be subject to decisions based solely on automated processing.
  • Right to withdraw consent: At any time, without affecting the lawfulness of processing prior to withdrawal.

You can exercise these rights by sending a written request to the email address responsable@yonathanrivas.com or to the postal address indicated in section 1. We will only request additional information, including a copy of your ID document, if there are reasonable doubts about your identity.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) if you believe your rights have not been addressed.

8. Source of the data

The personal data we process comes directly from the data subject through the following channels:

  • WhatsApp and phone calls.
  • Email.
  • Social media (LinkedIn).

The categories of data we process are: identifying data (name, surname, email, phone), technical browsing data such as IP address and technical server logs when generated by the hosting infrastructure, and, where applicable, financial data for managing the business relationship.

9. Security measures

We implement appropriate technical and organizational measures to ensure the security, integrity and confidentiality of your personal data, in compliance with the GDPR and the LOPDGDD.

Measures adopted include: encryption of communications, access controls, information security policies aligned with ISO 27001, and periodic data protection training.

10. Changes to the Privacy Policy

We may update this Privacy Policy to reflect changes in our data processing practices or in applicable regulations. We recommend you review this page periodically. The date of the last update is indicated at the beginning of this document.

11. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, you can contact us through: