Last updated: Friday, 18th September, 2026
1. Who is responsible for your data
This website, https://verobouza.com (the “Site“), is operated by:
- Data Controller: Veronica Bouza
- Legal/Trading name: Veronica Bouza Diaz
- Email: vero@verobouza.com
For any question about this policy or how your data is handled, you can contact me directly at the email above.
2. What data I collect
Depending on how you interact with the Site, I may collect:
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, email address, message content | Bloom.io |
| Newsletter data | Name, email address | [Newsletter signup] |
| Transaction data | Name, email, billing address, purchase history | Purchases / bookings (processed by Stripe / Bloom.io) |
| Technical data | IP address, browser type, device, pages visited, time on site | Google Analytics (via cookies) |
| Communication records | Emails, messages you send me | Direct correspondence |
I do not collect sensitive categories of data (health, religion, political opinions, etc.) through this Site, and I don’t knowingly collect data from anyone under 16.
3. Why I process your data (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to contact form enquiries | Legitimate interest / pre-contractual steps at your request |
| Sending the newsletter | Consent (opt-in) |
| Processing purchases of digital downloads or client bookings | Performance of a contract |
| Analytics (understanding how the Site is used) | Consent (via the cookie banner) |
| Complying with tax/accounting obligations | Legal obligation |
4. Who I share your data with
I don’t sell your data. I share it only with service providers who help me run this Site and business, acting as data processors under their own privacy terms:
- Google Analytics (Google Ireland Ltd.) — website analytics
- [NEWSLETTER] — newsletter management
- Stripe — payment processing
- Dubsado — client management, invoicing, and bookings
- Hostinger — website hosting
Some of these providers may process data outside the EU/EEA (e.g. in the US). Where that happens, they do so under adequacy decisions, Standard Contractual Clauses, or equivalent safeguards.
5. How long I keep your data
- Contact form messages: kept for as long as needed to handle your enquiry, then deleted or archived within a reasonable period.
- Newsletter data: kept until you unsubscribe.
- Transaction/invoice data: kept for the period required by Spanish tax law (generally 4–6 years).
- Analytics data: retained per Google Analytics’ default retention settings, or as configured in my account.
6. Your rights
Under the GDPR and Spanish data protection law (LOPDGDD), you have the right to:
- Access the data I hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (e.g. unsubscribe from the newsletter), without affecting prior processing
To exercise any of these rights, email me at vero@verobouza.com. I’ll respond within one month.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es — if you believe your data has been mishandled.
7. Security
I take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse. No online system is 100% secure, but I work with reputable providers (Stripe, Google, etc.) that maintain strong security standards.
8. Changes to this policy
I may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Significant changes will be noted on this page.
9. Contact
Questions about this policy? Reach me at vero@verobouza.com.