Privacy Policy

1. Data Controller

The data controller responsible for data processing on this website is:

2. Data Collection Overview

We collect personal data only when you voluntarily provide it — by sending us a message through the contact form or by booking a call — or when it is technically necessary to operate and protect this website. As a company established in Spain, we process data on the basis of the GDPR (Regulation (EU) 2016/679), the Spanish Data Protection Act LOPDGDD (Ley Orgánica 3/2018) and, where applicable, the Spanish Information Society Services Act LSSI-CE (Ley 34/2002).

3. Hosting

This website is hosted on Railway (Railway Corp., United States), deployed in Railway's European region (Amsterdam, Netherlands). Website data is therefore stored and served within the European Union. To deliver each page, Railway processes connection data including your IP address, the requested URL, browser type and user agent, and the time of access. This is based on our legitimate interest in the secure and efficient provision of our website (Art. 6(1)(f) GDPR). Because Railway Corp. is a US-incorporated company, we have a data processing agreement in place incorporating the EU Standard Contractual Clauses. For more information, see Railway's privacy policy: https://railway.com/legal/privacy

4. Server Logs and Abuse Prevention

Our server records error diagnostics when a message fails to send, and temporarily holds the IP addresses of visitors who submit the contact form in order to enforce a rate limit (a maximum number of submissions per minute). This protects the form against spam and automated abuse. These IP records are held in memory only, for a rolling window of approximately one minute, and are not written to a database or used to build a profile of you. The legal basis is our legitimate interest in the security and availability of our website (Art. 6(1)(f) GDPR).

5. Contact Form and Email Delivery

When you submit the contact form, we process the name, email address and message you provide. This data is used solely to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request) and, where your message does not concern a potential engagement, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Your submission triggers two emails: an internal notification to us, and a confirmation to the address you supplied that repeats the content of your message. Both are delivered through Resend (Resend, Inc., United States), which acts as our data processor under a data processing agreement incorporating the EU Standard Contractual Clauses. For more information, see Resend's privacy policy: https://resend.com/legal/privacy-policy

The form contains a hidden anti-spam field that is invisible to ordinary visitors. If it is filled in, the submission is discarded and no email is sent.

6. Appointment Booking (Cal.com)

We use Cal.com for appointment scheduling. The booking calendar is embedded from Cal.com's servers and is only loaded once you have submitted the contact form; until then, no connection to Cal.com is made from your browser. When the calendar loads, Cal.com receives your IP address and may set its own cookies or browser storage. When you book a call, Cal.com processes the data you provide (name, email, appointment details). Cal.com acts as our data processor. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures). For more information, see Cal.com's privacy policy: https://cal.com/privacy

7. Fonts and Third-Party Resources

All typefaces used on this website are hosted on our own servers. No connection to Google Fonts or any other external font service is made, and no visitor data is transmitted to Google.

Our homepage loads a small number of open-source JavaScript libraries from the public CDN unpkg.com in order to render an optional display-settings panel. When these files are requested, unpkg's operator receives your IP address and browser user agent. This is based on our legitimate interest in the efficient delivery of our website (Art. 6(1)(f) GDPR).

8. Cookies and Local Storage

This website sets no cookies of its own and stores nothing in your browser for tracking purposes. No advertising or profiling cookies are used. The only third-party browser storage that may be set is by the Cal.com booking calendar described in section 6, and only after you have chosen to proceed to booking. If consent-based cookies are introduced in the future, we will request your consent in accordance with Art. 6(1)(a) GDPR and Art. 22 LSSI-CE.

9. Analytics

This website does not use any analytics, tracking or advertising tools. If analytics are introduced in the future, they will be privacy-friendly and GDPR-compliant, and this privacy policy will be updated accordingly.

10. International Data Transfers

Some of the processors named above (Railway, Resend, Cal.com and the unpkg CDN) are established in the United States or may process data outside the European Economic Area. Where this occurs, the transfer is safeguarded by the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where applicable, by the processor's certification under the EU–US Data Privacy Framework. Website hosting itself takes place within the EU. You may request a copy of the relevant safeguards by contacting us at hello@williamjahn.net.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, please contact us at: hello@williamjahn.net. We will respond within one month.

If you believe we have processed your data unlawfully, you may lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the supervisory authority of your own place of residence.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Contact-form enquiries and the resulting email correspondence are kept for as long as needed to handle your request and for any subsequent business relationship; where an enquiry does not lead to an engagement, we delete it no later than two years after the last contact. Rate-limiting IP records are discarded after approximately one minute. Booking data held by Cal.com is retained in accordance with our account settings and their retention policy. Where Spanish commercial or tax law requires longer retention of business records, those periods take precedence.

13. Data Security

We use industry-standard technical and organisational measures to protect your data against unauthorised access, loss or misuse. All data transfers to and from this website are encrypted via TLS/SSL, and the contact endpoint is protected by rate limiting, request-origin checks and spam filtering.

14. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available on this page. We encourage you to review this page periodically.