Privacy policy

Illustration about Personal data protection and privacy web - joseenrique.es
Personal data protection and privacy

Last updated: 24 September 2026.

This policy explains what personal data I process when you visit joseenrique.es, why I use it, on what legal basis, who it is shared with and what rights you have. It follows Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

  • Controller: José Enrique Ibarra Fernández
  • Tax ID (NIF): 34849563D
  • Address: Calle Árbol del Paraíso, 3 — 04007 Almería, Spain
  • Email: jose@joseenrique.es

I am not required to appoint a data protection officer. For any question about your data, write to the address above.

2. What data I process, why and on what legal basis

Contact form and email

  • Data: name (optional), email address, subject and message, plus anything you include if you email me directly.
  • Purpose: to answer your enquiry and, where relevant, to continue any professional conversation that follows from it.
  • Legal basis: your consent, given by ticking the box on the form (Art. 6(1)(a) GDPR). If your enquiry is about hiring a service, also steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Retention: as long as needed to handle the enquiry and at most one year after the last exchange, unless a professional relationship begins or a legal obligation requires longer retention.

Blog comments

  • Data: name, email address (not published), website (optional), the comment, IP address and browser user agent.
  • Purpose: to publish and moderate comments and to filter spam.
  • Legal basis: your consent, given by ticking the box accepting this policy (Art. 6(1)(a) GDPR). The date, time and language of that acceptance are recorded as proof of consent.
  • Retention: for as long as the comment is published or until you ask for it to be deleted.
  • Anti-spam and avatars: comments are checked by Akismet to filter spam, and the avatar image is fetched from Gravatar using a hashed version of your email. Both services belong to Automattic Inc.
  • If you tick the corresponding box, your name, email and website are stored in a cookie in your browser so you do not have to type them again.

Analytics (Google Analytics 4 and Microsoft Clarity)

  • Data: pages visited, time on site, device and browser type, approximate location and pseudonymous identifiers stored in cookies. Clarity also records interactions with the page (clicks, scrolling and session recordings), with form fields and sensitive text masked.
  • Purpose: to learn which content is useful and how the site is used, so I can improve it. It is never used for advertising or commercial profiling.
  • Legal basis: your consent, given in the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) of the Spanish LSSI-CE). Without that consent no Google or Microsoft script is loaded.
  • Retention: Google Analytics data is kept for a maximum of 14 months; Clarity data according to Microsoft’s retention periods for that tool.
  • You can withdraw your consent at any time from the “Cookie preferences” link in the footer.

First-party visit counter, cookie-free

  • What it is: a visit counter running on this same server (Koko Analytics). It uses no cookies, stores nothing on your device and sends no data to third parties.
  • Data: page visited, referring page and date. To tell whether a visit is new, an encrypted fingerprint is computed on the fly from your IP address and browser, combined with a key that changes every day. Your IP is never stored and the fingerprint is only valid for that day: it is discarded when the key changes. The counter only keeps aggregated totals (visits per page and per day), which cannot identify you.
  • Purpose: to know how many people read each piece of content, without depending on you accepting analytics.
  • Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring the site’s audience in aggregate, with the least possible impact on your privacy.
  • Retention: the daily key is deleted after 24 hours; aggregated totals are automatically deleted after 24 months, within the 25-month maximum set by the Spanish Data Protection Agency (AEPD) for audience measurement.

Browsing and server security

  • Data: IP address, date and time, requested page and user agent, logged automatically by the server.
  • Purpose: to keep the site running securely and to detect unauthorised access.
  • Legal basis: legitimate interest in protecting the site and its users (Art. 6(1)(f) GDPR).
  • Retention: for the limited rotation period of the server logs, unless they are needed to investigate a security incident.

The cookies used on the site are listed in the Cookie policy.

3. Recipients and processors

I do not sell or share your data. Only the providers that deliver services to me have access to it, acting as processors with the safeguards required by Article 28 GDPR:

  • Web hosting: Euronodes Ltd hosts this website and its database, including the data you send through the forms, on servers located in the European Union. It acts as a data processor under a contract compliant with Article 28 GDPR. Only in the event of a security incident or a critical server fault may Euronodes carry out an automated analysis with a sub-processor in the United States, under the European Commission’s Standard Contractual Clauses.
  • Email: Microsoft Ireland Operations Limited (Microsoft 365), to receive and answer your messages, including those sent through the contact form.
  • Analytics: Google Ireland Limited (Google Analytics 4) and Microsoft Ireland Operations Limited (Microsoft Clarity), only if you consent.
  • Comments: Automattic Inc. (Akismet and Gravatar).

Your data will only be disclosed to public authorities where there is a legal obligation to do so.

The site links to LinkedIn, X and WhatsApp. These are plain links: they do not load any script from those services. If you choose to contact me through them, each platform processes your data under its own privacy policy.

4. International transfers

Google, Microsoft and Automattic belong to groups headquartered in the United States, so data may be transferred outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework, to which all three companies adhere and which the European Commission recognises as providing an adequate level of protection, and, where applicable, on the standard contractual clauses approved by the Commission. In addition, only in the event of a security incident or a critical server fault, Euronodes’ sub-processor in the United States may process the technical data from the automated analysis (processes, network connections and load), including IP addresses; that transfer relies on Standard Contractual Clauses.

5. Your rights

You can exercise the following rights at any time:

  • Access your personal data.
  • Rectify inaccurate data.
  • Request erasure.
  • Object to processing or request its restriction.
  • Request data portability.
  • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).

No automated decisions or profiling with legal effects on you take place on this site.

To exercise them, email jose@joseenrique.es stating which right you wish to exercise. I will reply within one month (Art. 12(3) GDPR). I will only ask for proof of identity if there are reasonable doubts about who you are (Art. 12(6) GDPR).

If you believe your data has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority of your country of residence.

6. Security

I apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), security headers on the server and two-factor authentication to access the site’s administration.

7. Minors

This site is aimed at professionals. I do not knowingly process data of children under 14 (Art. 7 LOPDGDD).

8. Changes to this policy

Any change will be published on this page, and the date at the top shows the latest revision. You can also read the Cookie policy and the Legal notice.