Privacy Policy

1. Data Controller

The data controller responsible for processing data collected through this website is Jose Diego Robles Pardo ("Jose Robles"), based in Spain. Contact email for inquiries and exercising rights: jose@josedrobles.com.

2. Personal Data Collected and Purpose

We only collect personal data when you explicitly provide it (for example, when contacting via email, booking a consultation via Cal.com, submitting an intake form, or requesting technical resources).

Categories of data processed:

• Inquiries and consulting: name, professional email address, company name, role, and technical project context.
• Resource download data (lead magnets): email address, requested resource, request language, source page (page_path), campaign parameters (utm_source / ref), internal campaign (motion_id), accepted consent text (consent_text), HTTP referer (referer), approximate country derived from network headers (cf-ipcountry), timestamps, and delivery status (delivered/failed).

Purposes of processing:

• Responding to professional inquiries, feasibility reviews, and consultation requests.
• Immediate technical delivery of the requested resource (lead magnet), and optional technical editorial briefings only when explicit consent is provided.
• Scoping and delivering technical due diligence, automation sprints, advisory, or engineering services.
• Maintaining verifiable audit trails of consent per GDPR requirements.
• Complying with statutory, accounting, and tax obligations in Spain.

3. Legal Basis

Processing is based on pre-contractual or contractual measures (GDPR Art. 6.1.b), legitimate interest in conducting professional business communications and abuse prevention (GDPR Art. 6.1.f), or explicit consent where requested (GDPR Art. 6.1.a).

4. Third-Party Processors and Subprocessors

To provide this website, maintain security, and communicate securely, we use the following GDPR-compliant processors. In the resource download flow (lead magnets), each processor handles exactly this data:

Cloudflare (Workers and D1): hosts the magnet_leads database and runs the capture endpoint. It stores the email address, requested resource, language, source page (page_path), campaign parameters (utm_source / ref), internal campaign (motion_id), consent text (consent_text), HTTP referer (referer), approximate country (cf-ipcountry), and delivery status (delivered/failed).

Cloudflare Turnstile: receives the connecting IP address (remoteip) and the anti-bot challenge signal to verify the request is not automated.

Cloudflare Web Analytics: privacy-first aggregated site measurement without cookies or personal data; it does not take part in the resource flow.

Whop: only if you accept the measurement banner, the Whop pixel records visits to product pages that link to Whop and attributes purchases completed on Whop (Whop Inc., United States). It does not take part in the resource download flow and it is not loaded otherwise.

Resend: receives the requester's email address and the content of the transactional email containing the resource link. If you tick the editorial box, Resend also handles adding your email to the editorial contact list.

Telegram: receives the internal notification with the email address, the resource, the source page (page_path), and the campaign origin (utm_source / ref).

WhatsApp Business (Meta): if you start a conversation on WhatsApp, your phone number and the message content are processed on Meta Platforms' platform to answer that conversation; it is a separate channel from the form and from resource downloads.

Cal.com: handles meeting bookings; it is a separate flow from resource downloads.

5. International transfers

Several processors (Cloudflare, Resend, Telegram, Meta, Cal.com and Whop) are companies or groups based in the U.S. or outside the European Economic Area, so the data listed in section 4 may be processed outside the EEA. These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified and, otherwise, on the Standard Contractual Clauses approved by the European Commission and included in each provider's data processing terms. You can request more information at jose@josedrobles.com.

6. Storage in your browser

The site sets no cookies of its own. While the page is open it keeps in memory the landing page, the referring website and the campaign parameters from the URL (utm_* / ref) so a request can be attributed to its source if you submit a form; that information is gone when you leave the page. Your choice (accept or decline) is stored in your browser's local storage so you are not asked again; only if you accept is the Whop pixel loaded to measure visits and attribute purchases on Whop on relevant product pages; Whop may set its own identifiers. You can withdraw or adjust that consent at any time via the Change measurement preferences control or by clearing this site's data in your browser; the site keeps working the same. Cloudflare Turnstile, on the forms, may use its own technical storage, needed for the anti-bot check you request when submitting them.

7. Data Retention and Rights

Personal data submitted through professional technical evaluation requests (intake) and technical resource downloads (magnet_leads) will be retained for 24 months from the last interaction, unless a contractual engagement is established or statutory retention obligations require a longer period. Editorial subscription data is retained until unsubscription is requested.

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, as well as data portability and immediate erasure upon request. To exercise any of these rights, contact jose@josedrobles.com. Erasure requests are fulfilled without undue delay.

If you believe the processing does not comply with data protection law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, https://www.aepd.es).