Privacy Policy

Last updated: 7 August 2026

1. Data controller

• Controller: Enrique Fuster
• Website: enfuster.com
• Privacy contact: mail@enriquefuster.com

2. Data processed

Depending on how you use the website, the following categories of personal data may be processed:

• Contact data: first name, optional last name, email address, and the contents of your message.
• Communication data: subsequent emails and information you voluntarily provide in connection with an enquiry.
• Technical data: IP address, browser and device information, requested URLs, timestamps, security events, and server logs generated when the website is delivered.
• Analytics data: pages viewed, approximate location, device and browser characteristics, broad traffic source, timestamps, scroll-depth milestones, and selected interactions such as opening the contact page or email link. Contact details and message contents are not sent to Analytics.
• Third-party media data: technical identifiers and interaction data that YouTube may receive when pages containing its embedded player are accessed.

Please do not send sensitive personal data or confidential third-party information through the contact form unless it is strictly necessary and you are authorised to do so.

3. Purposes and legal bases

• Responding to enquiries and project requests: to answer messages, understand a proposed project, and take steps requested before a possible agreement. The legal basis is the implementation of pre-contractual measures at your request (Article 6(1)(b) GDPR) and, for general enquiries, the legitimate interest in managing communications (Article 6(1)(f) GDPR).
• Operating and protecting the website: to deliver content, maintain availability, diagnose errors, prevent abuse, and preserve security. The legal basis is the legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
• Audience measurement: Google Analytics is used, only after an affirmative choice, to understand aggregate use of the website, traffic sources, useful pages, and contact intent. The legal basis is consent (Article 6(1)(a) GDPR and Article 22.2 LSSI). Advertising features, Google Signals, and ads personalisation are disabled.
• Displaying third-party video: YouTube is used to provide audiovisual content. Where consent is legally required for storage, access to a device, or associated processing, the applicable basis is consent (Article 6(1)(a) GDPR and Article 22.2 LSSI).
• Compliance and legal claims: to comply with legal obligations or establish, exercise, or defend claims where necessary (Articles 6(1)(c) and 6(1)(f) GDPR).

4. Recipients and service providers

Personal data is not sold. It may be accessible to providers strictly to the extent needed to operate the website and communications, including:

• Cloudflare: website delivery, hosting infrastructure, CDN, security, and asset storage.
• Google Analytics: consent-based audience measurement and aggregate reporting.
• Google/YouTube: embedded video delivery and playback.
• Form, hosting, and email providers: transmission, storage, spam prevention, and delivery of messages sent through the contact form or email.
• Public authorities, courts, or advisers: only where required by law or necessary for legal claims.

5. International transfers

Some providers may process data outside the European Economic Area, particularly in the United States. Where applicable, such processing must rely on a valid adequacy decision, including the EU–US Data Privacy Framework for participating organisations, Standard Contractual Clauses, or another safeguard recognised by the GDPR. Further information may be requested using the privacy contact above.

6. Retention

• Enquiries that do not result in an ongoing relationship are generally retained for no longer than 12 months after the last meaningful communication, unless earlier deletion is appropriate.
• If an enquiry leads to an agreement, relevant communications may be retained for the duration of the relationship and afterwards for the statutory limitation periods applicable to legal, accounting, or tax responsibilities.
• Technical and security logs are retained according to the operational and security periods applied by the relevant infrastructure provider.
• Google Analytics event and user-level reporting data is configured for a two-month retention period. Analytics cookies may remain for up to two years unless consent is withdrawn or browser data is deleted.
• Data required for a legal claim may be retained while that claim or related liability remains outstanding.

7. Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing where the corresponding legal requirements are met. Where processing is based on consent, you may withdraw it at any time without affecting previous lawful processing.

To exercise a right, email mail@enriquefuster.com, identifying your request and providing only the information reasonably necessary to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Required information

Fields marked as required in the contact form are necessary to receive and respond to your message. If they are not provided, the enquiry cannot be submitted or answered. Providing additional information is voluntary.

9. Automated decisions

No decisions producing legal or similarly significant effects are made solely by automated means, and the website does not create user profiles on behalf of Enrique Fuster.

10. Children

The contact form is not directed at children. If you are under 14, do not submit personal data through the website without the involvement of a parent or legal guardian.

11. Security and updates

Reasonable technical and organisational measures are used to protect personal data, although no Internet service can guarantee absolute security. This policy may be updated when the website, providers, or legal requirements change. The current version and update date will remain available on this page.