Privacy policy

Last updated: 2 October 2026

This policy explains how personal data is processed on carlosmendiola.com, in accordance with Andorran Law 29/2021 of 28 October on the protection of personal data (LQPD), its implementing regulation and, where applicable, Regulation (EU) 2016/679 (GDPR).

1. Data controller

• Owner: Carlos Mendiola Oria
• Address: Carrer Escoles, 3, AD600 Sant Julià de Lòria, Principality of Andorra
• Andorran tax number (NRT): F-370627-L
• Email: [email protected]
• Telephone: +376 607 466
• Activity: Product, project and digital strategy consultancy.

No data protection officer has been appointed, as one is not required for this activity. For any privacy question you can write to [email protected].

2. What data is processed

• Contact data you send voluntarily by email, phone or LinkedIn (name, email, phone, company and the content of your message).
• Client data needed to provide and invoice the services contracted (identification, contact, tax and billing data).
• Browsing data (IP address, device and browser type, pages visited) collected by technical providers and, only if you accept, by Google Analytics. See the Cookie policy.

This site has no forms and does not process special categories of data. It is not aimed at children under 16.

3. Purposes and legal basis

• Replying to your enquiries and maintaining the professional relationship. Basis: your consent when you get in touch and, where relevant, pre-contractual steps.
• Providing and invoicing the services contracted and meeting tax and accounting obligations. Basis: performance of a contract and compliance with legal obligations.
• Measuring site usage in aggregate to improve it (analytics). Basis: your consent, which you can give or withdraw in Cookie settings.
• Keeping the site secure and technically working. Basis: the controller’s legitimate interest.

No automated decisions or profiling with legal effects are carried out.

4. Retention periods

• Enquiries and contacts: for as long as the conversation lasts and at most 2 years after the last contact, unless a professional relationship begins.
• Client and billing data: for the duration of the relationship and afterwards for the periods required by Andorran tax and commercial law.
• Analytics data: as set out in the Cookie policy (maximum 24 months).

5. Recipients and processors

Data is not shared with third parties unless required by law (for example, with the tax authorities). The following providers act as processors to deliver the service:

• Web hosting and email provider.
• Cloudflare, Inc. (content delivery, security and consent management).
• Google LLC (Google Analytics and Google Fonts).

6. International transfers

Cloudflare and Google may process data in the United States. These transfers rely on the EU-US Data Privacy Framework, to which both companies have signed up, and on standard contractual clauses, in line with Article 43 et seq. of the LQPD. You can ask for more information at [email protected].

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and the right not to be subject to automated decisions, by writing to [email protected] with the subject “Data protection” and proving your identity. We will reply within one month.

Consent given for a specific purpose may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

If you believe your rights have not been respected, you can lodge a complaint with the Andorran Data Protection Agency: APDA, C/ Dr. Vilanova, 15-17, Nova seu del Consell General, planta -5, AD500 Andorra la Vella · tel. +376 808 115 · [email protected] · www.apda.ad.

8. Security

Appropriate technical and organisational measures are applied to protect data against loss, misuse or unauthorised access: encrypted connection (HTTPS), access control and providers with security guarantees.

9. Changes to this policy

This policy may be updated to reflect legal or service changes. The date of the last update is shown at the top.