Privacy policy

1. Data controller

1.1 David Franco Aguirre, under the GoRandom brand, Bilbao (Spain). Contact address for anything concerning this policy: [email protected].

1.2 Applicable law: Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights.

1.3 No data protection officer has been appointed, since none of the situations listed in Article 37 of the GDPR or Article 34 of the Organic Law applies. The controller deals with matters in person.

2. Data and purposes

2.1 This website has no user registration, no members’ area and no newsletter. There is therefore no visitor profile of any kind.

2.2 Contact form: name, e-mail address and the text of the message. Sole purpose: to handle and answer that enquiry.

2.3 Technical logs: IP address, user agent, resource requested and timestamp, recorded by the hosting provider and by the content delivery network. Purpose: to provide the service and hold back automated traffic.

2.4 Audience measurement: pages viewed and generic information about the device, with the IP address truncated before it is stored.

2.5 Advertising: advertising identifiers held in cookies, each of which is described in the cookie policy. Google sets out its own role in how Google uses information from sites that use its services.

3. Legal bases

3.1 For clause 2.2, Article 6(1)(b) GDPR: taking steps at the request of the data subject.

3.2 For clause 2.3, Article 6(1)(f): the controller’s legitimate interest in keeping a publicly available service up and protected, weighed against a minimal impact on the visitor.

3.3 For clauses 2.4 and 2.5, Article 6(1)(a): prior consent that is freely given, specific, informed and unambiguous, obtained through the consent notice, which displays the accept, reject and configure options at the same size and weight, with no pre-ticked box. Until consent is given, neither of those two processing operations writes or reads cookies: Google Analytics receives only a cookieless signal that a page has been viewed (Google Consent Mode), carrying no identifier that could link it to the visitor.

3.4 Access to the content does not depend on consent: refusing it does not restrict any page on this site.

4. Retention

4.1 Messages and the contact details attached to them: twelve months from the close of the correspondence.

4.2 Technical and security logs: rotated within weeks, with access restricted to diagnosing faults and blocking attacks.

4.3 Audience metrics: kept in aggregated form, from which no individual visitor can be identified.

4.4 Cookies: the lifetime of each cookie is stated in its row of the cookie policy.

5. Processors and disclosures

5.1 There are three processors, each bound by a contract that meets Article 28 GDPR and limited to its own role: the hosting provider, whose servers are in the European Union; Cloudflare, which delivers the pages and filters out malicious traffic; and Google, for measurement and advertising, which uses cookies only where consent has been given and, without it, nothing but the cookieless signal described in 3.3.

5.2 Data are not disclosed to third parties for those parties’ own purposes. Data are not sold. There is no profiling with legal effects and no automated decision-making within the meaning of Article 22.

6. International transfers

6.1 Part of the infrastructure described in clause 5.1 operates outside the European Economic Area.

6.2 Such transfers are based, in this order of priority, on a European Commission adequacy decision where one exists for the country of destination and, failing that, on the standard contractual clauses adopted by the Commission, under Article 46(2)(c) GDPR.

7. Exercising your rights

7.1 Data subjects have the rights of access (Article 15), rectification (16), erasure (17), restriction of processing (18), portability (20) and objection (21), and may also withdraw consent at any time, with effect from that moment onwards.

7.2 To exercise them, send an e-mail to [email protected]. No form, template or statement of reasons is required, and there is no charge.

7.3 Response time: one month from receipt, which may be extended as provided in Article 12(3) where the request makes this necessary, in which case the data subject would be told.

8. Supervisory authorities

8.1 A complaint may be lodged directly with a supervisory authority, without first having to complain to the controller.

8.2 The authority competent for the controller is the Spanish Data Protection Agency, AEPD (aepd.es). Residents of Catalonia may also turn to the Autoritat Catalana de Protecció de Dades (apdcat.gencat.cat) on matters within its remit, and residents of another European Economic Area country to the authority in their own country.

Last updated: October 2026.