Privacy Policy

Last updated: 1 July 2026

As a resident and registered autónomo in Spain, my services are subject to Spanish law which implements GDPR, the EU's data protection directive.

1. Data Controller

Identity: Pekka Gaiser

Address: Diseminado B-2, 35542 Tabayesco, Haría (Las Palmas), Spain

NIE (Foreign ID): Y34888723M

Email: pekka@pekka.net

Website: https://pekka.net

In compliance with Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016 (GDPR) and Spanish Organic Law 3/2018 of December 5 on Personal Data Protection and guarantee of digital rights (LOPDGDD), this document informs you about the processing of your personal data.

2. Purposes of Processing and Legal Basis

I process your personal data for the following purposes and legal bases:

2.1 Managing inquiries and contact

Purpose: Respond to inquiries made through the contact form or email
Legal basis: Consent of the data subject (Art. 6.1.a GDPR) and legitimate interest (Art. 6.1.f GDPR)
Data processed: Name, email, phone, message, and any additional information voluntarily provided

2.2 Service provision

Purpose: Execute contracted services such as web development, marketing and branding consulting, AI workflows and automations, and related professional services
Legal basis: Contract performance (Art. 6.1.b GDPR)
Data processed: Identification data, contact details, any information about your business you choose to share with me, and (where the engagement requires it) system access credentials and technical data of your web infrastructure

2.3 Billing and legal compliance

Purpose: Invoice issuance and tax obligation compliance
Legal basis: Legal obligation compliance (Art. 6.1.c GDPR)
Data processed: Name or company name, Tax ID, address, payment data

2.4 Website analysis and improvement

Purpose: Analyze website usage for improvement and optimization
Legal basis: Legitimate interest (Art. 6.1.f GDPR)
Data processed: Browsing data, IP address, browser type, pages visited

3. Special Categories of Data

3.1 Access credentials

When an engagement requires access to your technical systems, I may have access to:

Passwords and system access credentials
FTP/SSH access
Website administration credentials
API keys and configurations

Applied security measures:

Encrypted storage
Restricted access
Deletion according to your preference (immediate, 7 days, or indefinite retention upon express request)

3.2 Third-party data

If during service provision I have access to personal data of your customers or users, I will act as a Data Processor. I can formalize a Data Processing Agreement according to Art. 28 GDPR upon request.

4. Data Recipients

Your data may be communicated to:

4.1 Public Administrations

Spanish Tax Agency: For tax obligations compliance and electronic invoicing system (SII)
Other authorities: When required by law

4.2 Service providers (Data Processors)

Hosting providers:
- ALL-INKL.COM, Neue Medien Münnich (Germany)
- Hetzner Online GmbH (Germany)
- STRATO AG, Pascalstraße 10, 10587 Berlin (Germany). Hosts the self-hosted web analytics server (stats.pekka.net).
Cloud storage:
- Dropbox International Unlimited Company (Ireland). Transfers to Dropbox Inc. (USA) are made under the EU-U.S. Data Privacy Framework.
Payment processors:
- PayPal (Europe) S.à r.l. et Cie, S.C.A.
- Stripe Payments Europe, Ltd.

5. International Transfers

Data is primarily stored on servers located in the European Economic Area. When using Dropbox, transfers to the United States may occur under:

EU-U.S. Data Privacy Framework
EU Standard Contractual Clauses

6. Data Retention Periods

Retention periods vary by data type:

Data type	Retention period
Inquiries not converted to clients	1 year
Client data	During contractual relationship + 5 years (tax obligations)
Invoices and accounting documents	6 years (Spanish legal obligation)
Access credentials	According to your choice: immediate, 7 days, or indefinite
Web browsing data	3 months
Work backups	As agreed: immediate deletion or 30 days

7. Data Subject Rights

You have the right to:

Access: Obtain confirmation about your data processing and a copy thereof
Rectification: Correct inaccurate or incomplete data
Erasure ("right to be forgotten"): Request deletion of your data
Restriction of processing: Request suspension of processing in certain cases
Data portability: Receive your data in a structured, commonly used format
Opposition: Object to the processing of your data
Withdrawal of consent: Withdraw consent at any time

7.2 LOPDGDD Rights (specific to Spain)

Right not to be subject to automated decisions
Right of access to deceased persons' data (heirs)
Right to digital disconnection in the workplace

7.3 Exercising rights

To exercise these rights, send a request to: pekka@pekka.net

Attach a copy of your ID, NIE, or passport
Clearly indicate which right you wish to exercise
Response time: maximum 1 month from receipt

7.4 Complaint to the supervisory authority

You may file a complaint with:

Spanish Data Protection Agency (AEPD)

Address: C/ Jorge Juan, 6. 28001 Madrid
Phone: 901 100 099 / 912 663 517
Web: www.aepd.es
Electronic headquarters: https://sedeagpd.gob.es

For German clients: You may also file complaints with German data protection authorities.

8. Security Measures

I implement appropriate technical and organizational measures according to Art. 32 GDPR:

8.1 Technical measures

Encryption of data at rest and in transit (SSL/TLS)
Backup and recovery systems
Firewall and intrusion detection systems
Regular security updates
Two-factor authentication when possible

8.2 Organizational measures

Physical and logical access control
Data protection training
Contractual confidentiality
Incident management procedures
Periodic security assessments

9. Cookies and Web Analytics

9.1 Web analytics with Umami

I use Umami, a privacy-focused, open-source web analytics tool that I host myself on my own server (hosted by STRATO AG in Germany, EU; see the hosting providers in section 4.2). Because it is self-hosted, the analytics data stays under my control and is never shared with a third-party analytics provider. Umami:

Does not use cookies
Does not collect personally identifiable data
Does not require consent under GDPR
Does not track across websites
Fully complies with the GDPR

Data collected by Umami:

Page views and unique visitors (without identification)
Traffic sources (referrer)
Session duration
Country of origin (without precise geolocation)
Device and browser (general information)

The Umami software is open source. More information: https://umami.is

9.2 Technical cookies

The website uses only essential technical cookies:

Session management
Language preferences
Security and fraud prevention

These cookies are necessary for site functionality and do not require consent.

10. "Do Not Track" Information

I currently do not respond to "Do Not Track" browser signals as there is no uniform technological standard.

11. Minors

I do not provide services to minors under 18 years of age. If I become aware of having collected data from minors, I will proceed to immediately delete it.

12. Policy Modifications

I reserve the right to modify this privacy policy. Changes will be published on this page with the last update date indicated. I recommend periodically reviewing this policy.

13. Data Protection Officer

I am not required to appoint a Data Protection Officer under Art. 37 GDPR. For privacy inquiries, contact me directly at: pekka@pekka.net

14. Additional Information

14.1 Legitimate interest basis

When processing is based on legitimate interest, this consists of:

Improving my services
Preventing fraud and ensuring security
Direct marketing of similar services to existing clients

14.2 Automated decisions

I do not perform profiling or automated decisions that produce significant legal effects.

14.3 Data source

Data comes directly from the data subject or from website browsing.