Privacy policy
What data I collect, what for, how long I keep it and how to ask me to delete it. Spoiler: I collect the minimum and I don't sell it to anyone.
1. Data controller
- Controller: NovaOlmo — Jairo Vilanova Gutiérrez
- Tax ID (NIF/CIF): 43467693Q (Spanish tax ID)
- Registered address: [pending: registered address], Palma de Mallorca, Illes Balears, Spain
- Contact and privacy email: Jairovg26@gmail.com
2. What data I process and where it comes from
I only process the data you give me voluntarily when you get in touch:
- The contact form on this site: this form sends nothing to any server. It composes a message on your own device and opens WhatsApp so that you can review and send it yourself. What you type is not stored on this website.
- WhatsApp, email or phone: name, phone, email, business name and whatever you tell me about your project.
- Clients: additionally, the billing details needed to issue invoices and comply with Spanish tax obligations.
I process no special category data, buy no databases, and carry out no profiling or automated decision-making.
3. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and preparing a proposal | Your consent and the legitimate interest in handling requests (art. 6.1.a and 6.1.f GDPR) |
| Delivering the contracted service and supporting it | Performance of a contract (art. 6.1.b GDPR) |
| Invoicing and accounting | Legal obligation (art. 6.1.c GDPR) |
| Measuring anonymously how the site is used | Your consent, if given (art. 6.1.a GDPR) |
I will not send you advertising or newsletters you haven't expressly asked for.
4. How long I keep it
- Enquiries that don't become projects: up to 12 months, in case you pick the conversation back up. Then deleted.
- Clients: for the duration of the relationship and afterwards for the statutory retention period for tax and commercial records (generally 6 years; 4 years for tax matters).
- Analytics data: aggregated and anonymised, 14 months maximum.
5. Who I share it with
Nobody, apart from the providers I need in order to work, who act as processors under a signed contract with GDPR safeguards:
- Hosting and email provider (servers in the European Union).
- Tax and accounting advisers, for invoicing.
- WhatsApp/Meta, if you choose to write to me on that channel: their own privacy policy, which I don't control, applies as well.
I do not sell or share data with third parties for commercial purposes. I make no international transfers outside the European Economic Area other than those inherent to using WhatsApp, under the safeguards Meta declares.
6. Your rights
You can ask me at any time for:
- Access: to know what data of yours I hold.
- Rectification: to correct anything wrong.
- Erasure: to delete it.
- Restriction and objection: to stop using it for certain purposes.
- Portability: to hand it over in a reusable format.
- Withdrawal of consent you've given, without affecting what came before.
Write to Jairovg26@gmail.com saying which right you want to exercise. I reply within a month, usually within days. If you think I've handled it badly, you can complain to the Spanish Data Protection Agency (aepd.es).
7. Security
The site is served over HTTPS. Client data is held on European servers with encrypted backups and restricted access. I apply data minimisation: if I don't need a piece of information to do the work, I don't ask for it.
8. Changes and last review
If I change this policy I'll publish the new version on this same page with its date. Last reviewed: September 2026.