Privacy Policy

Last updated: 3 May 2026

This Privacy Policy is intended to inform Users of the rubenromay.com website (hereinafter, the “Website”) about the processing of personal data collected through it, in accordance with Regulation (EU) 2016/679 of 27 April (GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 (LSSI-CE).

1. Data controller

  • Controller: Rubén Romay Argibay
  • Spanish tax identification number (NIF): 43463470W
  • Address: Carrer Pons i Gallarza 27, 07004 Palma de Mallorca, Illes Balears, Spain
  • Email: info@rubenromay.com
  • Website: https://rubenromay.com/en/home-english/

2. Personal data we process and its purposes

We process the personal data you provide to us yourself, as well as data generated automatically through browsing. Specifically:

2.1. Contact form

  • Data: name, email address, subject and message.
  • Purpose: to respond to your enquiry or request for information and follow it up.
  • Legal basis: the data subject’s consent (Article 6(1)(a) GDPR), given when submitting the form.
  • Retention: for the duration of the relationship or enquiry and, afterwards, for the limitation period applicable to legal actions (up to 5 years, Article 1964 of the Spanish Civil Code).

2.2. Browsing and analytics

  • Data: IP address (anonymised), browser type, operating system, pages visited, browsing time, traffic source and similar data provided by cookies.
  • Purpose: to obtain aggregated, anonymous statistics on use of the Website in order to improve its content and user experience.
  • Legal basis: the data subject’s consent (Article 6(1)(a) GDPR), given through the cookie banner. Strictly necessary cookies are based on the Controller’s legitimate interest (Article 6(1)(f) GDPR).
  • Retention: in accordance with the periods specified in the Cookie Policy.

2.3. Blog comments (if enabled)

  • Data: name, email address, IP address and comment.
  • Purpose: moderation, publication and follow-up of the comment.
  • Legal basis: the data subject’s consent.
  • Retention: for as long as the comment remains published or until the user requests its deletion.

3. Recipients of the data

Personal data will not be disclosed to third parties unless required by law. However, in order to provide the service, the Controller uses data processors who have access to the data in their capacity as technology providers:

  • SeRed Telematic Services SLU (Spain) — hosting and email server provider. Data hosted in the EU.
  • Google Ireland Limited (Ireland) — Google Analytics 4 (website statistics), if you have accepted analytics cookies.
  • WPBeginner / Awesome Motive Inc. (United States) — CookieYes for managing cookie consent. International transfers are covered by the European Commission’s Standard Contractual Clauses (SCCs).

The Controller undertakes to enter into data processing agreements with each of these providers in accordance with Article 28 GDPR.

4. International transfers

Some technology providers may be located outside the European Economic Area. In such cases, transfers are made under the safeguards provided for in the GDPR: adequacy decisions of the European Commission, Standard Contractual Clauses or, in the case of the United States, the EU-U.S. Data Privacy Framework.

5. Retention periods

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and, where applicable, for the periods established by law to address potential liabilities.

6. Rights of the data subject

As a data subject, you may exercise the following rights with the Controller at any time:

  • Access: to know which of your data we are processing.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”): to request the deletion of your data.
  • Restriction of processing: to request that processing be restricted in certain circumstances.
  • Portability: to receive your data in a structured, commonly used format.
  • Objection: to object to the processing of your data.
  • Not to be subject to automated decisions with significant legal effects.
  • Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to info@rubenromay.com stating the right you wish to exercise and attaching a copy of your DNI or an equivalent document proving your identity.

7. Complaint to the supervisory authority

If you believe that the processing of your data does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid, or through its online office https://www.aepd.es.

8. Automated decisions and profiling

The Controller does not make automated decisions or carry out profiling that produces legal effects concerning the data subject or significantly affects them.

9. Security measures

The Controller has adopted appropriate technical and organisational measures to ensure the security of personal data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed. These include HTTPS/TLS encryption, hosting on a secure server within the EU and access restrictions.

10. Changes

The Controller reserves the right to amend this Privacy Policy to reflect legislative developments, case law and industry practices. The date of the most recent update appears at the beginning of this document.