Privacy Policy

Last updated: August 31, 2026

This Privacy Policy explains how personal data is handled when you visit iamalexflorian.com, contact Alex Florian, use the consent controls or follow links to external services. It is intended to provide clear information under the EU General Data Protection Regulation (GDPR), Spanish data-protection law and other privacy laws that may apply.

1. Controller and privacy contact

The controller for this website is Alex Florian, Madrid, Spain. The operator’s full public address appears in the Website Terms and Legal Information.

• Primary privacy contact: privacy@iamalexflorian.com
• Temporary alternate contact while that mailbox is being activated: iamalexflorian@gmail.com

These addresses are privacy contact channels; they are not described as a formally appointed data-protection officer.

2. Data handled through this website

• Inquiry data: your name, email address, selected topic, message and any timing or links you choose to include.
• Security and delivery data: IP address, request time, requested URL, browser or device information, diagnostic logs and security events generated by the website, hosting or content-delivery infrastructure.
• Consent data: your selected cookie categories, consent status and the information needed to remember or evidence that choice.
• Optional analytics data: page and screen activity, referrer, approximate location, device and browser characteristics, clicks, scrolling and interaction measurements when you consent to Statistics.
• External-service data: information a third party receives when you choose to open an external service or load consent-gated content.

The public contact form is not intended for passwords, payment-card data, government identifiers, health information or other sensitive personal data. Please do not submit such information unless a secure channel has been agreed.

3. Purposes and legal bases

• Responding to inquiries and evaluating a possible engagement: steps requested before a contract and the legitimate interest in communicating with people who contact the website.
• Delivering an agreed engagement: performance of a contract and compliance with related legal obligations where an engagement is formed.
• Operating, protecting and troubleshooting the website: legitimate interests in availability, abuse prevention, security and evidence of technical events, balanced against visitor rights.
• Remembering and demonstrating consent: compliance with legal obligations and the legitimate interest in respecting and recording visitor choices.
• Audience measurement and experience improvement: consent. Google Analytics 4 and Microsoft Clarity are treated as optional Statistics services and are not requested until Statistics consent is granted.
• Legal claims and compliance: compliance with legal obligations and legitimate interests in establishing, exercising or defending legal claims.

Where processing relies on consent, you may withdraw it at any time through Cookie settings or by contacting Alex Florian. Withdrawal does not affect processing that was lawful before withdrawal.

4. Contact-form operation

Contact-form submissions are delivered by email so the inquiry can be reviewed and answered. A short-lived rate-limit key derived from the submitted email address and IP address may be retained for approximately one minute to reduce duplicate or abusive submissions. Submitting the form does not create an advisory contract.

5. Analytics and session-replay tools

When Statistics consent is granted, the website may load:

• Google Analytics 4 (GA4): used to understand aggregate visits, traffic sources, navigation and selected site interactions. GA4 event-level retention is configured for 14 months.
• Microsoft Clarity: used for heatmaps and session playback to identify usability problems. Form fields are masked and the website does not intentionally send the contents of contact-form fields to Clarity. Microsoft states that playback data is retained for 30 days and heatmap, click, scroll, area, conversion, dashboard and favorited or labeled data is retained for 9 months.

These services can process online identifiers, IP-derived information and usage data. Denying or withdrawing Statistics consent prevents the website from requesting their analytics runtimes on subsequent page loads. Removing previously stored provider data may also require clearing browser storage using your browser controls.

6. Cookies, consent and embedded content

Strictly necessary technologies support security, page delivery and consent choices. Optional Statistics and Marketing technologies are controlled by the consent banner. Accept and Deny are presented as equivalent primary choices, preferences are available by category, and the footer’s Cookie settings control can be used to change or withdraw a choice. More detail appears in the Cookie Policy.

YouTube content is initially presented as a privacy placeholder rather than an active iframe. Choosing to load external content or opening Calendly, Udemy, YouTube or another third-party link can disclose data to that provider under its own policy. Merely displaying a normal external link does not by itself load the linked provider’s page.

7. Recipients and service providers

Data is disclosed only as reasonably needed for the purposes above. Recipients may include website hosting, content-delivery, security, email and technical-support providers; Google and Microsoft after Statistics consent; external platforms you choose to visit; professional advisers bound by confidentiality; and public authorities where disclosure is legally required.

Providers act under their own terms or appropriate processing arrangements depending on the service and role. This policy does not claim that every provider, subprocessor or recipient participates in the same international-transfer framework.

8. International transfers

Some providers may process data outside the European Economic Area. Where GDPR transfer rules apply, the relevant provider or controller must rely on an available mechanism such as an adequacy decision, participation by the specific receiving entity in an applicable data-privacy framework, or approved standard contractual clauses together with any required supplementary measures. You may request available information about the safeguard relevant to your data through the privacy contact.

9. Retention

• Inquiry records are kept while the inquiry is active and afterward only as reasonably needed for follow-up, business records, legal obligations or claims.
• The anti-abuse rate-limit key described above is designed to expire after approximately one minute.
• GA4 event-level retention is configured for 14 months.
• Microsoft states that Clarity playback data is retained for 30 days and the Clarity reporting data described above for 9 months.
• Consent and security records are kept for the period reasonably needed to evidence choices, protect the service and meet legal obligations.
• Cookie durations and provider-specific storage are described in the Cookie Policy where available.

Retention can be extended where information is needed to establish, exercise or defend a legal claim, or shortened when it is no longer necessary.

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection; withdraw consent; and object to processing based on legitimate interests. You may also ask for information about relevant international-transfer safeguards.

Send a request to privacy@iamalexflorian.com or, while that mailbox is being activated, iamalexflorian@gmail.com. Enough information may be requested to verify identity and locate the relevant data. Requests are normally answered within one month under GDPR, subject to lawful extensions or exceptions.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority. Contacting Alex Florian first is welcome but not required.

11. Required data and automated decisions

Fields marked as required are needed to route and answer an inquiry. If they are not provided, the form cannot be submitted. Other message details are optional. The website does not use submitted inquiry data to make solely automated decisions that produce legal or similarly significant effects.

12. US and California transparency

For visitors in the United States, the categories described above include identifiers, internet or electronic-network activity, approximate geolocation derived from technical data and professional information you choose to include in an inquiry. They are used for the purposes and disclosed to the categories of recipients stated in this policy.

The website does not currently apply a separate response to the browser’s legacy “Do Not Track” setting because there is no uniform standard for that signal. Optional analytics are instead controlled through the site’s consent controls. Where a privacy law that applies to this activity grants an additional right or requires recognition of a specific opt-out preference signal, requests will be assessed and handled as that law requires. This statement does not assert that Alex Florian meets the business thresholds of every US state privacy law.

13. Security and children

Reasonable technical and organizational measures are used to reduce unauthorized access, alteration, loss or disclosure. No internet service can guarantee absolute security. The website and advisory offers are intended for professional audiences and are not directed to children. If you believe a child has submitted personal data, contact Alex Florian so it can be assessed and, where appropriate, deleted.

14. Changes to this policy

This policy may be updated when the website, providers or legal requirements change. Material changes will be reflected by revising the date above and, where appropriate, by providing an additional notice. Earlier processing remains subject to the policy and law that applied at that time.