Privacy Policy
Last updated: 14 October 2026
This is an English translation provided for convenience. If there is any discrepancy, the Spanish version prevails.
This policy explains how I process the personal data of people who visit adrianmerah.com or contact me, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). If you are in Mexico, please also see the Aviso de Privacidad (in Spanish).
1. Data controller
- Owner: Adrián Merah Núñez
- Tax ID (NIF): 48724577C
- Address: Calle San Antonio, 7, 28696 Pelayos de la Presa, Madrid (Spain)
- Email: info@adrianmerah.com
- Website: https://adrianmerah.com
I have not appointed a Data Protection Officer because I am not required to. For any privacy question, write to info@adrianmerah.com.
2. What data I process, why, and on what legal basis
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Compliance Pulse newsletter | Name (optional), email, date, IP and sign-up form; opens and clicks | Sending you the newsletter (news, job opportunities in the sector and, where applicable, updates on my services and training) and measuring how it performs | Your consent (Art. 6(1)(a) GDPR; Art. 21 LSSI) | Until you unsubscribe. After that I keep only your email on a suppression list so I don't write to you again |
| Self-assessment | Name, email, country, answers and result | Sending you the assessment, answering any questions you ask about it and, only if you tick the relevant box, sending you two follow-up emails with recommendations | Your consent (Art. 6(1)(a) GDPR) | 12 months if no professional relationship begins |
| Email enquiries | The data you provide (usually name, email, company and message content) | Answering your enquiry and, if you ask, preparing a proposal | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) or legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) | 12 months from the last communication, unless an engagement begins |
| Meeting bookings | Name, email, Calendly form answers, date and time | Scheduling and holding the meeting | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | 12 months after the meeting if no engagement begins |
| Web analytics | Cookie identifiers, browsing and device data, truncated IP | Producing usage statistics to improve the website | Your consent (Art. 6(1)(a) GDPR; Art. 22.2 LSSI) | 2 months in Google Analytics |
| Hosting and security | IP, date, requested page and browser (server logs) | Serving the website and protecting it against abuse | Legitimate interest in the website's security (Art. 6(1)(f) GDPR) | The hosting provider's technical retention period |
| Clients | Identification, contact, billing and engagement data | Providing and invoicing the contracted services | Performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR) | During the engagement and then for the legal periods (6 years for commercial records) |
Your country preference (Spain or Mexico), if saved, is stored only in your browser and is never sent to any server.
I do not process special categories of data or make decisions based solely on automated processing that produce legal effects concerning you. The self-assessment result is indicative and is generated by fixed rules applied to your answers.
Data marked as mandatory in the forms is needed to handle your request. If you do not provide it, I will not be able to do so.
3. Recipients
I do not share your data with third parties unless required by law. These providers process it on my behalf, as processors, under a contract in line with Article 28 GDPR:
| Provider | Service | Location and safeguards |
|---|---|---|
| MailerLite Limited | Newsletter and self-assessment | Ireland (EU) |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 (only with your consent) | EU and US. Google LLC participates in the EU-US Data Privacy Framework. |
| Calendly LLC | Meeting bookings | US. Data Privacy Framework or standard contractual clauses |
| Netlify, Inc. | Website hosting | US. Data Privacy Framework or standard contractual clauses |
| IONOS SE | Domain email | EU |
| Proton AG | Switzerland, a country with a European Commission adequacy decision |
If we meet by video call, the video-conferencing provider named in the invitation will also process the data needed for the call.
4. International transfers
Some providers may process data in the United States. These transfers rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR), for participating companies, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). You can ask for more information at info@adrianmerah.com.
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before.
- How: write to info@adrianmerah.com stating which right you want to exercise. I will only ask you to prove your identity if I have reasonable doubts about it.
- Newsletter: you can unsubscribe using the link at the end of every email.
- Cookies: you can change your choice under "Cookie settings" in the footer of every page.
- Timing: I will reply within one month at the latest, which may be extended in the cases provided for in Article 12(3) GDPR.
- Complaints: if you believe I have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
6. Minors
The website and its services are intended for people aged 18 and over. I do not knowingly process data of children under 14. If I find that a minor has given me data without authorisation from their legal guardians, I will delete it.
7. Security
I apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), security headers, restricted access to the tools I use and processing agreements with providers.
8. Changes to this policy
I may update this policy when the processing or the law changes. The date of the last update appears at the top. If the change is significant and I have your email, I will let you know.