This page explains how the personal data of visitors to the website https://jorgeml.com/ is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
1. Data controller
- Data controller: Jorge Manuel Muñoz Lozano
- Tax ID (NIF): 46470400G
- Address: Av. Carmen Amaya 16-11-1ª, Barcelona, España
- Email: info@jorgeml.com
- Telephone: +34 615 313 814
2. What data is processed and where it comes from
- Data you provide in the forms (contact, pricing calculator and briefing questionnaire): name, email address and, if you choose to provide them, phone number, company and information about your project (type of website, technology, budget, message or questionnaire answers). You don’t need to provide any data to browse the website.
- Browsing data: pages visited, where the visit came from, device and browser type, country and, for a sample of visits, clicks, scrolling and movement through the pages. Your IP address is not stored: it is only used to generate a pseudonymized visit identifier (see section 3).
No special categories of data are processed.
3. Why it is used and on what legal basis
- Replying to your request and preparing a quote. Legal basis: your consent, given when you submit the form accepting this policy, and taking pre-contractual steps at your request (Art. 6(1)(a) and 6(1)(b) GDPR).
- Managing the relationship with clients who hire a service, including invoicing. Legal basis: performance of the contract and compliance with legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
- Measuring and improving the website with Umami Analytics, a cookieless analytics tool managed by the Data controller: usage statistics and, for a sample of visits, heatmaps and session recordings. Anything typed into the forms is masked in the recordings. Legal basis: the Data controller’s legitimate interest in understanding how the website is used in order to improve it (Art. 6(1)(f) GDPR), with minimal impact on your privacy: no cookies are used, your IP is not stored, and no profiles are built nor is the data used for advertising. You can object at any time (see section 6).
No automated decisions are made and no profiles are built with your data.
4. How long it is kept
- Contact or quote requests that don’t lead to a contract: one year from the last contact. They are then deleted.
- Client data: for the duration of the relationship and, afterwards, for the periods required by law (for example, under tax and commercial rules for invoicing).
- Session recordings: automatically deleted after 30 days.
- Usage statistics: kept in aggregate form, without data that identifies you.
5. Who else processes the data
Your data is not disclosed to third parties, except where required by law. To run the website, the Data controller relies on providers that process data only on its instructions (data processors):
- Vercel: website hosting and processing of form submissions.
- Resend: delivery of form messages to the Data controller’s inbox.
- Supabase: analytics database (Umami).
- Hostinger: the Data controller’s email service, where messages are received.
Some of these providers are based in the United States, so international data transfers may take place. These transfers are carried out with the safeguards provided for in the GDPR: the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.
6. Your rights
You can exercise the following rights at any time:
- Access to your data.
- Rectification of inaccurate data.
- Erasure of your data.
- Restriction of processing.
- Objection to processing, including analytics based on legitimate interest.
- Portability of the data you have provided.
- Withdrawal of any consent you have given, without affecting the lawfulness of prior processing.
To exercise them, email info@jorgeml.com stating which right you wish to exercise. Additional information to verify your identity will only be requested if there are reasonable doubts about it. You will receive a reply within one month at the latest.
If you believe your data has not been processed correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Cookies and browser storage
This website does not use cookies. It only stores small technical data in your browser that is needed for the website to work, as detailed in the Cookie Policy.
8. Security
The Data controller applies appropriate technical and organizational measures to protect your data against loss, misuse or unauthorized access: encrypted connection (HTTPS) across the whole website, restricted access to the data and providers with high security standards.
9. Minors
This website is not aimed at children under 14. If you are under that age, please do not submit your data through the forms.
10. Accuracy of data
You undertake to provide truthful data and to report any changes so that the information is kept up to date.
11. Changes to this policy
This policy may be updated to reflect legal changes or changes in how the website works. The date of the last update is shown at the top of this page.