Privacy policy
What personal data I collect through this website, what I use it for, who I share it with and how you can exercise your rights.
Last updated:
This is an English version provided for convenience. In the event of any discrepancy, the Spanish version (Política de privacidad) prevails.
Data controller
- Controller: Gerardo Millán Castellón
- Tax ID (NIF): 43565026J
- Address: C/ Joan Fivaller, 31, 08940 Cornellà de Llobregat (Barcelona)
- Email: [email protected]
- Website: https://gerardmillan.com
This policy applies to personal data processed through https://gerardmillan.com and is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
What data I process and why
Contact form
- Data: name, company, email address, company size and the message you write.
- Purpose: to reply to your enquiry and, where relevant, prepare a proposal.
- Legal basis: your consent when you submit the form (Art. 6(1)(a) GDPR) and steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Retention: for as long as needed to handle your enquiry. If we end up working together, for the statutory periods that apply to the contractual, tax and accounting relationship.
All form fields are needed for me to reply with a useful proposal; if you leave them blank I can’t handle the enquiry this way (you can email me or use WhatsApp instead).
The form is processed by Web3Forms, a service that turns each submission into an email sent to me.
Cost calculator
To send you the calculator’s result, I ask for your email as the last step.
- Data: your email, the figures you enter (people, hours and hourly cost), the result and, if you provide it, the task that takes up most of your time.
- Purpose: emailing you the estimate, notifying me of your request and replying with ideas for your case. Only if you tick the optional box, sending you occasional emails about automation.
- Legal basis: your request to receive the estimate (pre-contractual steps at your request, Art. 6(1)(b) GDPR) and, for marketing emails, your consent (Art. 6(1)(a) GDPR and article 21 LSSI-CE), which you can withdraw at any time by replying to any email or writing to [email protected].
- Retention: until you ask for erasure or withdraw consent and, if we don’t end up working together, at most 2 years from our last contact.
The calculation runs on Cloudflare (the website’s host) and emails are sent through Resend, an email delivery service.
Booking a call
The Google Calendar booking page only loads when you click “Show the calendar”. If you book a call, Google Calendar collects the details you enter (usually your name and email address, plus anything you add about the reason for the call) in order to manage the appointment. The legal basis is steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). I keep this data for as long as needed to hold the meeting and follow it up.
Payments
Payments are made through Stripe Payment Links. Stripe acts as an independent controller for payment data (card details and verification) under its own privacy policy. I do not have access to your full card details.
From Stripe I receive your name, email address and billing details, which I use to issue the invoice and deliver the service you have bought. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR). I keep this data for the periods required by tax and commercial law.
The WhatsApp links on this site open WhatsApp, a Meta service. If you choose to message me there, the conversation is subject to WhatsApp’s terms and privacy policy. I only use what you send me to reply to you, based on your consent.
Analytics
I use Plausible Analytics, an EU-hosted analytics service that uses no cookies and stores no personal data. I only see aggregated statistics (pages visited, country, device type, referral source) that cannot identify you. More detail in the cookie policy.
Hosting and security
The website is hosted on Cloudflare Pages. To deliver pages and protect the site against attacks, Cloudflare processes technical data such as IP addresses and access logs. The legal basis is my legitimate interest in keeping the website available and secure (Art. 6(1)(f) GDPR).
Marketing emails
I do not send newsletters or marketing emails without your prior, express consent (article 21 LSSI-CE). If I ever do, you will be able to unsubscribe from every message.
Automated decisions
I do not make decisions based solely on automated processing of your data, and I do not profile you.
Recipients and processors
I do not sell or pass on your data to third parties. Only the providers needed to run the website and the services have access to it, under the conditions described above:
- Cloudflare (hosting and security).
- Web3Forms (contact form delivery).
- Resend (sending the calculator emails).
- Google (Google Calendar booking page for calls).
- Stripe (payments, as an independent controller).
- Plausible Analytics (aggregated statistics with no personal data).
- Meta / WhatsApp (only if you choose that channel).
I may also disclose data to public authorities where required by law (for example, the Spanish Tax Agency).
International transfers
Some of these providers (Cloudflare, Web3Forms, Resend, Google and Stripe) may process data outside the European Economic Area. Where applicable, these transfers rely on the Standard Contractual Clauses approved by the European Commission or on the EU-US Data Privacy Framework for certified organisations.
Data protection officer
Given the volume and type of data I process, I am not required to appoint a data protection officer. I handle any privacy question directly at [email protected].
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by emailing [email protected]. Tell me which right you want to exercise; if I need to verify your identity, I will only ask for the minimum information necessary.
Where you have given consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
If you believe your data has not been handled properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Security
I apply reasonable technical and organisational measures to protect your data: encrypted connections (HTTPS) across the whole site, restricted access to provider accounts and the use of services that offer appropriate safeguards.
Changes to this policy
I may update this policy if the services I use or the law change. The date of the latest update is shown on this page (2026-11-07).