This policy explains which personal data I process when you visit this website or contact me, why, on what legal basis, and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD).
1. Controller
Javier Español Muñoz (Optimierung Marketing) · VAT ES70253217Q · Calle Lisboa 16, Portal B, 6.º C, 31620 Huarte (Navarra), Spain · info@optimierungmarketing.com · +34 640 923 559.
I have not appointed a data protection officer, as I am not required to.
2. What data I process and why
2.1 Visiting the website (technical data)
When you open the website, the server automatically logs technical connection data: IP address, date and time, page requested, browser and operating system, and referring website.
- Purpose: delivering the website securely and detecting attacks.
- Legal basis: legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
- Retention: up to 7 days on the hosting provider's (STRATO) servers; then deleted.
2.2 Website security (Wordfence)
I use the Wordfence security firewall, which checks requests to the website (including the IP address) to block malicious access. The provider is Defiant, Inc. (USA).
- Legal basis: legitimate interest in protecting the website and the data it holds (Art. 6(1)(f) GDPR).
- International transfer: where Defiant processes data in the USA, this is based on the European Commission's standard contractual clauses in its data processing agreement.
2.3 Contact form, email, phone and WhatsApp
If you write to me through the form, I process the data you provide: first name, last name, email address, website and your message (on some pages also your type of business or the status of your account). If you contact me by email, phone or WhatsApp, I process the data of that communication.
- Purpose: replying to your enquiry and, if you ask, preparing a review or proposal.
- Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).
- Retention: for the duration of the conversation and up to 12 months after the last contact if we do not end up working together. If a contract is signed, statutory retention periods apply (for example, 6 years for accounting records under Spanish law).
- WhatsApp: the WhatsApp button is a simple link. Only if you use it does WhatsApp Ireland Limited process your data under its own privacy policy.
2.4 Spam protection for the form
To prevent automated submissions, the form includes a hidden field that only automated programs fill in and a filter that rejects messages written in Cyrillic script. Both run on this website itself, without external services or cookies.
- Legal basis: legitimate interest in protecting the form against spam (Art. 6(1)(f) GDPR).
2.5 Web analytics (Google Analytics 4), only with your consent
If you accept analytics cookies, I use Google Analytics 4 (Google Ireland Limited), via the Site Kit plugin, to see how many people visit the website, which pages they view and whether they submit the form or click on phone, email or WhatsApp. Google Analytics 4 does not store full IP addresses.
- Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 22.2 LSSI). Without consent, Google Analytics works in the cookieless mode of Google's consent mode and does not identify you.
- Withdrawal: at any time via the cookie icon at the bottom of the website.
- Retention: data linked to cookies or identifiers is deleted after 14 months.
- International transfer: Google LLC (USA) is certified under the EU-US Data Privacy Framework.
2.6 Consent management (CookieYes)
The cookie banner (CookieYes plugin, installed on this website) stores your choice in a cookie and logs your consent in the website database so it can be demonstrated.
- Legal basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).
- Retention: consent log up to 3 years (limitation period under the Spanish Data Protection Act); cookie with your choice, 1 year.
2.7 Website language
The website remembers your chosen language (Spanish, German or English) in a strictly necessary cookie. Legal basis: legitimate interest in showing the website in your language (Art. 6(1)(f) GDPR).
2.8 Clients
If we work together, I process the contact and billing data needed for the contract (Art. 6(1)(b) GDPR) and to meet tax and accounting obligations (Art. 6(1)(c) GDPR). When I work in your Google Ads, Merchant Center or GA4 accounts, I process data on your behalf; this is governed by a separate data processing agreement.
I do not use your data for automated decision-making or profiling with effects on you. I do not send newsletters or marketing emails.
3. Recipients and processors
I do not sell or share your data. Only service providers working for me, under a data processing agreement, have access:
- STRATO GmbH (Germany): hosting of the website and its database, and sending of form notifications.
- Google Ireland Limited (Ireland): Google Analytics 4.
- Google Cloud EMEA Limited (Ireland), Google Workspace: email inbox where your emails and form notifications arrive.
- Defiant, Inc. (USA): Wordfence security firewall.
I may also disclose data to public authorities where required by law.
4. International transfers
Some providers (Google and Defiant/Wordfence) may process data in the USA. Transfers to companies certified under the EU-US Data Privacy Framework rely on the European Commission's adequacy decision of 10 July 2023; otherwise, on the European Commission's standard contractual clauses.
5. Your rights
You may at any time request access, rectification, erasure, restriction of processing and data portability, object to processing, and withdraw consent without affecting the lawfulness of earlier processing. Write to info@optimierungmarketing.com and I will reply within one month.
Right to object: where processing is based on my legitimate interest, you can object on grounds relating to your particular situation.
You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country of residence.
6. Are you required to provide data?
No. I only need the fields marked as required in the form to reply to you.
Last updated: November 2026
