Privacy policy
This policy explains what personal data I process when you visit carlosmendiola.com or contact me, why I use it and what rights you have. It is based on Andorran Law 29/2021, of 28 October, on the protection of personal data (LQPD), and its implementing regulation (Decree 391/2022).
1. Data controller
- Owner: Carlos Mendiola Oria, independent professional
- NRT (Andorran tax registration number): F370627L
- Business address: Carrer Escoles, 3, AD600 Sant Julià de Lòria (Andorra)
- Email: hola@carlosmendiola.com
- Phone: +376 607 466
- Activity: professional services in digital marketing, web product and digital strategy
I have not appointed a data protection officer because my activity does not require one. For any question about your data, write to me directly at hola@carlosmendiola.com.
2. What data I process, why and on what basis
This website has no forms or private areas. I only process the data you give me when you contact me and the data generated while you browse.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your messages and contact requests (email, phone or LinkedIn) and, where relevant, preparing a professional proposal. | Name, contact details, company and whatever you tell me in your message. | Your consent when you write to me and, if you ask for a proposal, taking pre-contractual steps at your request. | For as long as the conversation lasts and up to 12 months after the last contact. If a professional relationship begins, for its duration and the periods required by Andorran tax and commercial law. |
| Website usage statistics with Google Analytics 4, through Cloudflare Zaraz. | Pages visited, traffic source, device and browser type, approximate location and pseudonymous online identifiers. | Your consent, which you can withdraw at any time. | 14 months in Google Analytics. Analytics cookies last 24 months at most. |
| Website security and technical operation (protection against attacks and bots, server logs). | IP address, date and time, requested page and technical browser data. | Legitimate interest in keeping the website secure and available. | Only as long as needed for the security of the service, in line with server and Cloudflare log rotation. |
| Recording your cookie choice. | Consent preferences and date. | Compliance with a legal obligation: being able to demonstrate consent. | Up to 12 months. |
If you contact me through LinkedIn, that platform also processes your data under its own privacy policy.
3. Minors
This website is not aimed at children under 16. If you are under that age, please do not send me personal data without the permission of your parents or guardians.
4. Recipients and processors
I do not sell or share your data with third parties unless required by law. To run the website and email, I work with the following providers, who act as data processors under the appropriate contractual safeguards:
- OVHcloud: hosting of the website server.
- Cloudflare, Inc.: content delivery network, security and consent management (Cloudflare Zaraz).
- Google: business email (Google Workspace) and usage statistics (Google Analytics 4, only with your consent).
5. International transfers
Cloudflare and Google may process data in the United States. Both companies participate in the EU-US Data Privacy Framework, which the European Commission recognises as ensuring an adequate level of protection, a criterion the LQPD accepts for international transfers. They also apply standard contractual clauses as an additional safeguard.
6. Automated decisions
I do not make decisions based solely on automated processing or build profiles that have legal effects on you.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as the right not to be subject to automated decisions and to withdraw any consent you have given, without affecting the lawfulness of prior processing.
To exercise them, write to me at hola@carlosmendiola.com stating which right you wish to exercise. If I have reasonable doubts about your identity, I may ask for additional information to confirm it. I will reply within one month from the day after I receive your request. This may be extended by two further months where necessary, given the complexity or number of requests, in which case I will let you know within the first month.
If you believe I have not handled your rights properly, you can lodge a complaint with the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, APDA): www.apda.ad.
8. Security
I apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), restricted access to data and providers with recognised security guarantees.
9. Changes to this policy
I may update this policy if the law or the way I process data changes. The version in force is always the one published on this page.
Last updated: 9 October 2026.
Back to home