Privacy notice

1.1In this notice: the Regulation means Regulation (EU) 2016/679, the General Data Protection Regulation; the LOPDGDD means Spanish Organic Law 3/2018 of 5 December, on the protection of personal data and the guarantee of digital rights; the Site means the website published at www.ittaisavran.com, in either language; the Controller, I and me mean Ittai Savran, identified in clause 2; you and the data subject mean the person to whom the personal data relate; and an Engagement means a scope of work agreed in writing and signed by the Controller and a client.

1.2Personal data, processing, controller, processor and supervisory authority carry the meanings given to them in article 4 of the Regulation.

1.3A reference in this notice to an article, without more, is a reference to an article of the Regulation. Headings are for convenience and do not affect construction.

2.1The controller of the personal data processed through the Site is Ittai Savran, holder of Spanish tax identification number Y7513137V, with professional address at Modolell 6, 08021 Barcelona, Spain, acting in his own name as an independent consultant.

2.2The Controller determines the purposes and the means of every processing operation described in this notice.

2.3The contact page of the Site lists every means of contacting the Controller, and a request under clause 12 may be made by any of them.

2.4No data protection officer has been appointed, and none is required. The Controller is a sole practitioner, and the processing described here involves neither large scale processing of special categories of data nor regular and systematic monitoring of data subjects on a large scale within the meaning of article 37.

3.1This notice covers the processing of personal data carried out through the Site, in both of its languages.

3.2It does not cover processing carried out within an Engagement, which is governed by the terms of that Engagement and, where the Controller processes personal data on behalf of a client, by a processing agreement meeting the requirements of article 28.

3.3It does not cover third party websites reached from a link on the Site, each of which publishes a privacy notice of its own.

4.1Contact form: name, email address, company where voluntarily supplied, and the content of the message. Every field is supplied by the data subject.

4.2Booking a call: the calendar is operated by Calendly. Nothing belonging to Calendly is loaded until the button is pressed, so no request reaches Calendly from a visitor who does not book. A booking supplies a name, an email address and a time. The link carries a tag identifying the page from which it was opened; that tag describes the page and not the data subject.

4.3Correspondence: messages exchanged with the Controller, and whatever the data subject chooses to include in them.

4.4Language cookie: a single cookie named locale, holding the value en or es and nothing further, set only where the language switch is used, limited to the Site, and expiring one year after it is set.

4.5Visit measurement: the hosting provider records that a page was opened, the approximate country of origin and the type of device. Nothing is stored on the device for this purpose. To distinguish one visit from another within a single day the measurement is derived from the request itself, and that derivation is discarded after twenty-four hours.

4.6Technical records: records generated by the hosting and email providers in the course of serving a page or delivering a message, including IP address and timestamps, retained by them for their own security and operational purposes.

4.7The Site carries no advertising, no advertising identifier, no profiling and no cross-site tracking.

4.8The Radar: an email address, a name where voluntarily supplied, the subjects, markets and formats selected by the data subject, anything typed into a free-text field, the date and time of subscription, the date on which the address was confirmed, and the consent wording shown to the data subject together with the revision of that wording it was. Every field is supplied by the data subject, and the selections describe what the data subject asked to be sent rather than any conclusion drawn about them.

4.9Radar reactions: where a subscriber presses one of the three links under an item, a record of which item and which of the three, and when. A later press on the same item replaces the earlier one. It records what the subscriber thought of a piece of writing; nothing is inferred from it about the subscriber.

5.1To respond to an enquiry and to take steps prior to a possible Engagement: article 6(1)(b), steps taken at the request of the data subject prior to entering into a contract.

5.2To reply to correspondence not concerning an Engagement: article 6(1)(f), the legitimate interests described in clause 6.

5.3To arrange and hold a booked call: article 6(1)(b) where it concerns a possible Engagement, and otherwise article 6(1)(f).

5.4To keep the Site operating, secure and available, and to measure at the level of a page which parts of it are read: article 6(1)(f).

5.5To remember the language selected: the cookie is strictly necessary in order to provide a service expressly requested by the user, and falls within the exception in article 22.2 of Spanish Law 34/2002, which is why the Site requests no consent and displays no banner.

5.6To comply with legal obligations, including the accounting and tax obligations arising from an Engagement: article 6(1)(c).

5.7To compose and send the Radar, a weekly email whose subject matter is chosen by the data subject: article 6(1)(a), consent. Completing the form does not by itself subscribe an address: a message is sent to it containing a single link, and nothing is sent to that address again unless the link is followed. Consent is given by ticking a box that is never pre-ticked, is evidenced by that confirmation together with the record of the wording ticked, and is withdrawable at any time by the link carried in every issue or by writing to the address in clause 2. Withdrawal does not affect the lawfulness of processing carried out before it.

5.8To learn from the reactions which items are worth sending and which are not: article 6(1)(f), the legitimate interests described in clause 6. The reaction is read as a judgement of the item and not of the person who gave it, and no profile of any subscriber is built from it.

5.9Personal data are not processed for any purpose incompatible with those set out above. The Radar is the only mailing list maintained, it is sent only to those who asked for it, and its contents are chosen from the subject matter selected rather than from any observation of the data subject. No other marketing is sent, and no profile of any data subject is constructed.

6.1Where the Controller relies on article 6(1)(f), the interests pursued are replying to a person who has made contact, and operating, securing and improving the Controller's own website.

6.2Those interests have been weighed against the rights and freedoms of the data subject. The processing goes no further than replying to the message sent; the visit measurement is constructed so as not to identify anyone; and neither involves special categories of data, data concerning children, or systematic monitoring.

6.3A data subject may object to processing on this basis at any time, under article 21 and clause 12.

7.1There is no obligation to provide personal data in order to use the Site. Reading it requires nothing of the visitor.

7.2The fields marked as required on the contact form are required only in the sense that an enquiry cannot be answered without a means of reply and a subject matter. The contact page offers other means of making contact.

8.1Vercel, which hosts the Site, serves each page and operates the visit measurement described in clause 4.5.

8.2Resend, which delivers messages sent through the contact form and each issue of the Radar, and holds them transiently in the course of delivery.

8.3Supabase, which provides the database in which a Radar subscription is stored — the address, the name where given, the selections made, and the reactions to items. It is the only place a subscriber's address is kept, and it is not shared with any other list or service.

8.4The Radar is written by a language model. It is given the subjects selected by subscribers and never an address, a name or anything identifying a subscriber, so no personal data are disclosed to the provider of that model.

8.5Calendly, which operates the booking calendar and retains the bookings made through it.

8.6The provider of the Controller's professional email, in whose service the resulting correspondence is stored.

8.7Each of the above acts as a processor on the Controller's instructions under terms meeting the requirements of article 28 or, where it determines its own purposes, as a controller under its own privacy notice.

8.8Personal data are not sold, rented, exchanged or otherwise made available to any other recipient, and are disclosed to a public authority only where a law or a judicial decision so requires.

9.1Certain of the providers named in clause 8 are established in, or process personal data in, countries outside the European Economic Area, including the United States.

9.2Where such a transfer occurs it takes place under the safeguards set out in that provider's data processing terms, which may include the standard contractual clauses adopted by the European Commission or an adequacy decision covering the provider.

9.3On request the Controller will identify the provider relevant to a data subject's personal data and indicate where its terms may be consulted.

10.1Enquiries and the correspondence following them: for as long as the matter may remain of commercial relevance, which in practice is some years, since an enquiry made in one year frequently becomes an Engagement in another. Earlier erasure is carried out on request, unless retention is required by law.

10.2Bookings: for as long as the calendar record remains useful, and thereafter under the retention policy of Calendly.

10.3Records connected to an Engagement, including invoices: for the periods required by Spanish commercial, accounting and tax law, which the Controller is not at liberty to shorten.

10.4A Radar subscription: until it is withdrawn, and thereafter only the record that consent was given and withdrawn, and when, which is kept as evidence that the withdrawal was acted on.

10.5A subscription whose address is never confirmed: erased thirty days after the form was completed. Nothing is ever sent to it in the meantime.

10.6Radar reactions: until the subscription they belong to is stopped, at which point they are erased with it.

10.7The language cookie: one year from the date on which it is set, or until it is deleted by the user.

10.8The visit measurement: the daily derivation described in clause 4.5 is discarded after twenty-four hours, and what remains is aggregate and identifies no one.

11.1The Site is served over an encrypted connection, and the providers named in clause 8 apply their own technical and organisational measures to the data they hold.

11.2No method of transmission or storage is completely secure, and electronic mail in particular is not a confidential channel. Special categories of data, personal data concerning third parties, credentials and privileged material must not be sent through the Site or by email.

12.1The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and access to those data (article 15), their rectification (article 16), their erasure (article 17), restriction of processing (article 18), portability of the data they supplied (article 20), and to object to processing founded on legitimate interests (article 21).

12.2Where processing is founded on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

12.3Rights are exercised by writing to the Controller by any means listed on the contact page. There is no form and no charge. The Controller may request evidence of identity, so as not to disclose personal data to a person other than the data subject.

12.4A response is given within one month of receipt of the request, extendable by two further months where the request is complex, in which case the data subject is informed of the extension and its reasons within the first month.

12.5The data subject may lodge a complaint with the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, aepd.es. The Controller asks to be given the opportunity to resolve the matter first.

13.1No decision producing legal effects concerning a data subject, or similarly significantly affecting them, is taken by automated means, and no profiling within the meaning of article 22 is carried out on the Site.

13.2The contents of the Radar are composed by a language model and are reviewed and released by the Controller before any issue is sent. That composition is applied to the subject matter selected and not to the data subject, it produces the same text for every subscriber who selected the same subjects, and it is neither a decision concerning anyone nor profiling within the meaning of article 22.

14.1The Site addresses professionals in the real estate and hospitality sectors. It is not directed at minors, and personal data concerning persons under the age of eighteen are not knowingly collected. Personal data believed to have been supplied by a minor are erased upon notification.

15.1This notice may be amended to reflect a change in the Site, in the providers behind it, or in the applicable law. The version in force is the one published on the Site, identified by the version number and the date at the head of this page.

15.2Where an amendment materially affects the processing of personal data, that fact is stated on this page rather than left to be discovered.

16.1This notice is published in English and in Spanish. In the event of any discrepancy between the two versions, the Spanish version prevails.

16.2This notice, and the processing described in it, are governed by the Regulation, by the LOPDGDD and by any other applicable Spanish law.