Privacy policy
Last updated: 1 September 2026
This policy explains what personal data is collected on andermirambell.com, what it is used for, how long it is kept and what you can do about it. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD). This is a translation for convenience; in case of discrepancy, the Spanish version prevails.
1. Data controller
- Owner: Ander Mirambell Viñas
- Tax ID (NIF): 39383957R
- Address: C/ Sepúlveda 65, office 1, 08015 Barcelona, Spain
- Privacy contact:info@andermirambell.com
- General contact:info@andermirambell.com
- Website: https://andermirambell.com
No data protection officer has been appointed, as the processing does not meet any of the conditions in Article 37 GDPR.
2. What data is collected
2.1. Contact form
This is the only channel through which the site collects data you provide directly:
- Name (required).
- Email address (required).
- Phone number (optional).
- Subject (required): speaking, documentary, press, sponsorship or other.
- Message (required) and any data you choose to include in it.
- Source page and language the form was sent from. These technical fields are added automatically and tell us the context of your message.
The form also contains a hidden anti-bot field that collects nothing about you: if an automated program fills it in, the message is discarded and never sent.
2.2. Browsing data
If you consent in the cookie notice, aggregated browsing statistics are collected (pages viewed, referral source, device type, approximate country) through Google Analytics 4 via Google Tag Manager. Without that consent no measurement runs at all. Details are in the cookie policy.
2.3. Server logs
The hosting provider automatically logs data such as IP address, request timestamp and user agent for security, abuse prevention and error diagnosis. These logs are kept for short periods and are not used for profiling.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Reading your message and replying to it. | Your consent, given by ticking the box and submitting the form (Art. 6(1)(a) GDPR). |
| Preparing or negotiating a collaboration when you write about a talk, a sponsorship or a screening. | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). |
| Measuring use of the site through aggregated statistics in order to improve it. | Your consent (Art. 6(1)(a) GDPR and Art. 22.2 of Spanish Law 34/2002, LSSI-CE). |
| Keeping the site secure and preventing automated abuse. | Legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR). |
| Complying with legal obligations and official requests. | Compliance with a legal obligation (Art. 6(1)(c) GDPR). |
There is no automated decision-making with legal effects and no profiling that significantly affects you. Contact form data is not used to send you marketing: separate consent would be requested for that.
4. Retention periods
- Contact form messages: for as long as needed to deal with your request and then up to one year from the last contact, unless the relationship is still live.
- If a collaboration is agreed: for its duration and afterwards for the limitation periods applicable to accounting, tax and liability obligations (up to 6 years, Article 30 of the Spanish Commercial Code).
- Statistical data: according to the Google Analytics 4 retention setting, up to a maximum of 14 months for user and event data.
- Your cookie choice: 12 months, after which you are asked again.
Once those periods expire, data is deleted or irreversibly anonymised.
5. Who else has access
Data is never sold or transferred to third parties for their own purposes. The following providers act as processors under an Article 28 GDPR agreement:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting and technical logs. | United States, with servers in the European Union. |
| Resend, Inc. | Delivery of the email generated by the contact form. | United States. |
| Google Ireland Limited | Google Tag Manager and Google Analytics 4, only with your consent. | Ireland, with access from Google LLC (United States). |
Your message is also received in the controller’s mailbox, hosted by his email provider.
Public authorities, courts and law enforcement bodies may also access data where there is a legal obligation.
6. International transfers
Some of those providers are established in the United States. Transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) where the provider is certified and, failing that, on the Standard Contractual Clauses approved by the European Commission together with supplementary measures. You can request a copy of these safeguards at the address in section 1.
7. Your rights
You may exercise the following rights at any time:
- Access: find out what data about you is being processed.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask for deletion when the data is no longer needed.
- Objection: object to processing based on legitimate interest.
- Restriction: ask that data be kept but not used while a claim is resolved.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to info@andermirambell.com stating which right you wish to exercise and attaching a copy of a document proving your identity. You will receive a reply within one month at the latest.
If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; www.aepd.es). We would appreciate hearing from you first: most things are settled with a single email.
8. Security
The site is served entirely over HTTPS. Form data travels encrypted, is not stored in any website database and is delivered straight to the controller's mailbox by email. Access keys for third-party services are held as server environment variables and are never exposed in the browser.
9. Minors
This site is not aimed at children under 14 and does not knowingly collect their data. If we detect data belonging to a minor without the authorisation of a parent or guardian, it will be deleted.
10. Changes to this policy
This policy may be updated to reflect legal changes or changes to how the site works. The date of the last revision appears at the top of the page. If a change affects the purpose of the processing or its legal basis, it will be flagged prominently.
11. Measurement and cookies
The site uses Google Tag Manager and Google Analytics 4, always subject to your consent. Details of each cookie, its lifetime and how to change your choice are in the cookie policy.