Privacy policy
Last updated: September 29, 2026
This page explains what personal data manuelsuarez.es processes, for what purposes, for how long, and what you can do about it. The website has no forms, user registration, or open comments: data comes in when you write or call, when you accept statistics in the cookie banner, when you press play on a YouTube video and, in part, simply because you visit it.
Controller
The controller is Manuel Suárez Gutiérrez, with tax ID (NIF) 28823485T and address at Calle Carranza 6, 28004 Madrid. For any privacy matter, the email address is info@manuelsuarez.es.
Summary
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact by email or phone | Name, email address, phone number, and whatever you say in your message | Replying, preparing quotes, and managing commissions | Your request for a quote or the commission (Art. 6(1)(b) GDPR); legitimate interests in answering other inquiries and people who write on behalf of a company (Art. 6(1)(f) GDPR); tax and commercial obligations (Art. 6(1)(c)) | One year from the last message if there is no commission; if there is one, for as long as it lasts and then six years from the last entry in the accounting books |
| Visit statistics | Random identifier, pages viewed, time with the page in the foreground, scrolling, clicks on email, phone, and external links, device, approximate location | Understanding how the website is used | Your consent (Art. 6(1)(a) GDPR) | 14 months |
| Loading Google Tag Manager | IP address and technical browser data | Having the tag manager loaded, which activates analytics only if you accept it | Legitimate interests (Art. 6(1)(f) GDPR) | According to Google, HTTP request logs are deleted within 14 days; diagnostics are aggregated |
| Serving the website | IP address, requested page, date and time, browser | Making the website work and keeping it secure | Legitimate interests (Art. 6(1)(f) GDPR) | IONOS keeps access logs for a maximum of 8 weeks, with the IP address anonymized |
| Google fonts | IP address and technical browser data | Displaying the website with its fonts | Legitimate interests (Art. 6(1)(f) GDPR) | The website does not keep it; what Google retains is set out in its policy |
| YouTube videos | IP address, technical browser data, and the data the player stores in your browser | Playing the video you press play on | Your consent when you press play (Art. 6(1)(a) GDPR) | The website does not keep it; what Google retains is set out in its policy |
Each processing activity is described in detail below.
If you write or call
When you write to info@manuelsuarez.es, call +34 659 891 684, or send a message on Instagram, the data you provide is processed: your name, your email address or phone number, the content of the message, and anything you attach, such as briefs, references, or files. You are not required to provide any data, but without an email address or a phone number it is not possible to reply to you.
The data is used to reply to you, to prepare a quote and, if a commission follows, to manage and invoice it. If you ask for a quote or for information about work for yourself, the legal basis is taking steps at your request prior to entering into a contract and, if there is a commission, the contract (Article 6(1)(b) GDPR). If you write on behalf of a company or for another reason, the legal basis is the legitimate interests in answering whoever writes and in maintaining the relationship with the company you represent (Article 6(1)(f) GDPR and, for professional contact details, Article 19 of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, LOPDGDD). Invoices and commission documents are kept because tax and commercial law require it (Article 6(1)(c) GDPR).
If the conversation does not lead to a commission, the messages are deleted one year after the last one. If there is a commission, the data is used for as long as it lasts. After that, only the invoices, the accepted quote, and the correspondence about the commission are kept, for six years from the last entry made in the accounting books, which is the period that Article 30 of the Spanish Commercial Code sets for the documents of a business. During that time they are blocked: they are not used for anything else and would only be made available to judges, courts, or authorities that request them. When the period ends, they are destroyed (Article 32 of the LOPDGDD).
The email is hosted by IONOS Cloud S.L.U., which is a processor. Messages on Instagram are also processed by Meta under its own privacy policy.
Visit statistics
If you accept analytics cookies in the cookie banner, the website measures visits with Google Analytics 4, loaded through Google Tag Manager. If you do not accept analytics, Google Analytics does not record your visit; what Google Tag Manager does in that case is explained at the end of this section.
With your consent, the following is collected: a random identifier stored in a cookie in your browser, the pages you visit and when, the page you came from, the type of device and browser, and the approximate city and country. The time during which the page is in the foreground is also recorded, as is whether you scroll almost to the end (90% of its height), when you click an email or phone link, and when you click a link that leads to another website, such as Instagram. For the clicks measured, the address of the link clicked may also be sent. In the tests performed after the player changes on September 29, 2026, the projects “Luis Larr – Los directos de Allegra” and “Luis Larr – Maradona” generated no video-event requests for Google Analytics with analytics accepted. The current players do not enable the programming interface used by enhanced measurement. No video events were observed in the check of videos hosted on the website itself either. The identifier does not include your name or email address, but it allows your browser to be recognized from one visit to the next, so the data is pseudonymous.
Accepting analytics does not authorize any advertising use. Through its consent mode, the website tells Google that storage and use of data for advertising purposes are denied (the ad_storage, ad_user_data, and ad_personalization signals).
Google states that, for visitors from the European Union, Google Analytics uses the IP address only to derive approximate location and discards it without logging it (EU, Switzerland, or UK-focused data and privacy).
The legal basis is your consent (Article 6(1)(a) GDPR and Article 22(2) of Law 34/2002 on information society services and electronic commerce, LSSI). You can withdraw it at any time with the cookie settings button that appears in a corner of the screen after you choose, or with the “Cookie settings” link in the footer of the website. From that moment on, the website stops measuring your visits.
Google Analytics keeps the data about your visits for 14 months. Data linked to your identifier is deleted 14 months after your last visit. Reports with aggregated figures, which do not allow anyone to be identified, may be kept longer. Google Ireland Limited provides the service as a processor. The website does not have the advertising features of Google Analytics (Google Signals) enabled and is not linked to Google Ads. The collection of user-provided data, including its automatic detection, is disabled in the Google tag and in the Google Analytics property.
Even if you do not accept analytics, Google Tag Manager is downloaded from googletagmanager.com when each page opens and may send Google technical diagnostics about the tags. Those requests communicate your IP address and technical browser data to Google; no cookie is set. About the diagnostics, the Tag Manager help says: “Google Tag Manager may collect some aggregated data about tag firing. This data does not include user IP addresses or any measurement identifiers associated with a particular individual.” According to the same page, data in standard HTTP request logs is “deleted within 14 days of being received.” The legal basis is the legitimate interests in having the tag manager loaded, which activates analytics only if you accept it (Article 6(1)(f) GDPR).
Serving the website
The website is hosted by IONOS Cloud S.L.U. To serve each page, its server receives your IP address, the address of the page you request, the date and time, and the type of browser. This is the minimum needed for the website to work and to detect abuse or attacks. The legal basis is the legitimate interests in keeping the website available and secure (Article 6(1)(f) GDPR). IONOS is a processor. According to the IONOS help on log files, it keeps access logs for a maximum of 8 weeks and anonymizes visitors’ IP addresses in them.
Google fonts
The website’s fonts are loaded from Google Fonts. To download them, your browser connects to fonts.googleapis.com and fonts.gstatic.com, and Google receives your IP address and technical browser data. No cookies are set. The legal basis is the legitimate interests in displaying the website with its fonts (Article 6(1)(f) GDPR). Google processes that data under its own privacy policy.
Videos hosted on the website
Most of the project videos are hosted on the website itself. They are downloaded from the same server as the pages, and watching them does not connect your browser to any other service.
YouTube videos
Some projects include videos hosted on YouTube, a service of Google Ireland Limited. Until you press play on one, the page does not connect to YouTube.
Next to each video there is this notice, with links to Google’s privacy policy and to the cookie policy: “Plays from YouTube. Pressing play loads the YouTube player from youtube-nocookie.com: Google receives your IP address and the player stores some data in your browser. Google does not say what each item is for; its privacy policy applies. According to Google, views in this mode are not used to personalize YouTube or the ads you see. Pressing play means you accept this, and closing the video unloads the player.”
When you press play, your browser loads the YouTube player from www.youtube-nocookie.com, the domain of YouTube’s privacy-enhanced mode, and the player then requests the image, the video, and its own resources from other Google domains. Google receives your IP address and technical browser data, and the player stores data in your browser; which data is explained in the cookie policy. Google does not say what each item of that data is for; its privacy policy applies. In the tests performed after the player changes on September 29, 2026, using Chrome 154 and a fresh context without existing cookies for each test, no cookies set by the YouTube player were observed. Safari and Firefox have not been tested.
According to Google, “the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize the YouTube browsing experience” and “will not be used to personalize advertising shown to the viewer outside of your site or app,” and if ads are served on the video, “those ads will likewise be non-personalized” (Privacy Enhanced Mode).
The legal basis is your consent (Article 6(1)(a) GDPR): pressing play, with the notice in view, means you accept it. To stop using a player, close it with “Close video”: this removes it from the page and it stops communicating with YouTube. How to delete what it has already stored is explained in the cookie policy.
Who receives the data
The data is not sold. It is processed on behalf of the owner by IONOS Cloud S.L.U. (hosting and email) and Google Ireland Limited (statistics, only with your consent). If there is a commission, the invoice data is also processed, on behalf of the owner, by the tax advisory firm that files the owner’s taxes, and it is included in returns to the Spanish Tax Agency when the law requires it.
Google also receives your IP address and technical browser data when your browser downloads the fonts or the Tag Manager script and when you press play on a YouTube video, and processes them under its own privacy policy. If you write on Instagram, Meta processes the message under its own policy.
The data would only be handed over to judges, courts, or other authorities when the law requires it.
Transfers outside the European Economic Area
Google may process statistics, fonts, Tag Manager, and YouTube data in the United States through Google LLC. Google LLC participates in the EU-U.S. Data Privacy Framework (Google), and the European Commission decided that this framework ensures an adequate level of protection in Implementing Decision (EU) 2023/1795, under Article 45 GDPR. For transfers that the framework does not cover, Google applies the European Commission’s standard contractual clauses (Article 46 GDPR).
According to its data processing agreement (in Spanish), IONOS processes data in the European Union or the European Economic Area and only transfers it outside when necessary, with the safeguards of Articles 44 et seq. GDPR.
Your rights
No automated decisions that affect you are made with your data, and no profiles are built to make them (Article 22 GDPR).
You can request access to your data, its rectification or erasure, object to its processing, request the restriction of its processing, and request its portability. You can also withdraw any consent you have given at any time, without affecting the processing carried out before.
To exercise these rights, write to info@manuelsuarez.es stating which right you want to exercise. If there are reasonable doubts about your identity, you may be asked to prove it. You will receive a reply within one month, which may be extended by two further months if the request is complex; in that case, you will be informed within the first month.
If you believe your data has not been processed properly, you can lodge a complaint with the supervisory authority, the Spanish Data Protection Agency (AEPD) (aepd.es).
Changes
If what the website does with data changes, this page will be updated and the date at the top will change.