Privacy policy

How your data reaches me

When you fill in the contact form, what you have written travels to an external service that composes and delivers an email to my contact inbox. The form does not store your data in the booking database.

If you use the built-in booking calendar, I store your name, email address, and appointment date and time in a database to manage the booking, changes and reminder. You receive the details by email.

You can also write to me by email or WhatsApp, in which case I process whatever you yourself send me.

While you only browse the site, no identifying data about you is processed.

Who the data controller is

Controller, [legal name], tax ID [tax ID], hereinafter Okami Security.

Email address, [email protected]

What data I process and where it comes from

The contact form data. Name, email address, subject and the content of your message. Name and email are mandatory because without them I cannot reply.

Booking data: name, email address, language and the appointment date and time.

If you write to me on WhatsApp, the number you write from and the content of the conversation.

The technical logs of the hosting server, which the provider keeps with the IP address among the usual data, for security and so the site works.

I do not process special categories of data, I build no profiles and I make no automated decisions affecting anyone. I send no commercial communications either, what you write is used to reply to you and for nothing else.

Purpose and legal basis

Attending your enquiry and preparing a quote. The legal basis is the application of pre-contractual measures at your request, article 6.1.b of the GDPR, or, when the enquiry is not aimed at hiring, your consent by writing to me, article 6.1.a.

Maintaining the communication arising from that enquiry and, if you hire me, delivering the contracted service and issuing the invoice. In that case the legal basis is the performance of the contract.

How long I keep the data

Your enquiry data is kept as long as necessary to attend it. If the enquiry ends in a contract, it is kept while the relationship lasts and afterwards for the period tax and commercial law requires. After that period it is deleted.

Cancelled bookings are deleted from the database after 30 days and completed bookings after 90 days. Conversation emails are kept for the period applicable to the enquiry or contract.

Who else has access to the data

I do not sell or hand over personal data to third parties for commercial purposes. Only the technical providers that make the site and the communication possible have access, as data processors.

Cloudflare, Inc., hosting of the site and email for the domain. Logs requests to the server with the usual technical data.

Web3Forms, the service that composes and delivers the email generated by the contact form. It receives what you write in the form in order to pass it on to me.

Resend, which delivers booking confirmations and reminders by email.

Google Calendar, when the video call integration is enabled, receives the appointment date and time to generate a separate Google Meet link. The event does not include your name or email address.

Google Meet, if its link is used for the video call.

Additionally, data may be disclosed to public authorities, judges and courts where there is a legal obligation.

Whether data is transferred outside the European Economic Area

The providers mentioned belong to groups with parent companies in the United States and may process data there. Those transfers rely on the EU-US Data Privacy Framework, declared adequate by the European Commission, or on standard contractual clauses, and only the minimum necessary data is processed.

What your rights are

You can exercise free of charge the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as withdraw your consent at any time, by writing to [email protected] and stating the right you want to exercise.

If you believe your request has not been properly attended, you can complain to the Spanish Data Protection Agency, calle Jorge Juan 6, 28001 Madrid.

Security

The site is static and all traffic is served over HTTPS, so it stores no data on its own servers. Audit documentation is worked on and stored with encryption and restricted access, as befits a security professional.

Changes to this policy

I may update this policy when the way data is processed changes. The current version is always the one published on this page, with its review date, and changes do not apply retroactively to data already processed.