Privacy policy

Who is responsible for processing your data?

• Controller: Sergi Palau Popis
• Address: Barcelona, Spain
• Email: sergi@sergipopis.com
• The owner also acts as Data Protection Officer, to whom any questions about the processing of your personal data may be addressed.

What personal information do we collect?

• Through the contact form: name, email address and the message you send us.
• Basic navigation data (IP address, browser type, pages visited) that may be recorded in server logs for technical and security reasons.
• We do not collect credit card data, sensitive data or any other personal data actively beyond what is described above.
• All personal data processed by sergipopis.com comes directly from the data subject.

What do we use your personal data for?

• Responding to your enquiry: managing messages received through the contact form.
• Managing the commercial relationship: where a service contract arises, managing it including invoicing and communications necessary for the service.
• Responding to the exercise of your privacy rights and handling queries, requests and complaints.
• Prevention, detection and control of fraudulent or abusive use of the website.
• Service improvement: quality actions to assess your satisfaction and improve content and services.

How long do we keep your personal data?

Your personal data will be kept only for as long as is reasonably necessary to handle your enquiry and, where applicable, for the duration of the contractual relationship plus applicable legal limitation periods. If no commercial relationship arises, contact form data will be deleted within 12 months of the last contact. After this period, data will be blocked and subsequently deleted from all systems, unless there is a legal obligation to retain it.

What is the legal basis for processing your data?

• Consent of the data subject (Art. 6.1.a GDPR): managing the enquiry submitted through the contact form. You may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Performance of a contract (Art. 6.1.b GDPR): where a service relationship arises, processing is necessary for its performance.
• Compliance with a legal obligation (Art. 6.1.c GDPR): invoicing and responding to privacy rights requests.
• Legitimate interest (Art. 6.1.f GDPR): prevention and detection of fraud and abusive use of the site, and sending satisfaction surveys about contracted services.

Who do we share your data with?

• Public authorities and bodies when required by tax, labour or other applicable law.
• Resend (resend.com): data processor for sending emails from the contact form. Processes data in compliance with the GDPR.
• Vercel (vercel.com): website hosting provider. May log basic access data for technical purposes.
• Where an international data transfer is necessary, the parties involved will have previously demonstrated the adoption of appropriate safeguards.
• sergipopis never sells your personal data to third parties.

How does sergipopis protect your data?

• The website uses encrypted HTTPS (TLS) connections for all communications.
• Emails are sent via Resend with encrypted connections.
• Access to systems processing personal data is restricted to the owner.
• All necessary technical and organisational measures have been adopted to ensure security, confidentiality and integrity of data.

What are your privacy rights?

• Right of access: obtain confirmation of whether we are processing your personal data and access it.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Right to restriction: request restriction of processing in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interest or for direct marketing purposes.
• Automated individual decision-making: not to be subject to decisions based solely on automated processing that produce significant legal effects.
• Right to lodge a complaint: with the Spanish Data Protection Agency (aepd.es) if you believe processing does not comply with the GDPR.

How to exercise your rights

You may exercise any of these rights by emailing sergi@sergipopis.com stating the right you wish to exercise and identifying yourself. We will respond within one month of receiving your request.

Amendments to this privacy policy

Should we modify the content of this policy, we will notify you through the website or by email when changes significantly affect your privacy, so that you can review them and, if appropriate, exercise your rights.