Privacy policy

Last updated: 25 August 2026.

This policy explains how personal data is processed when you visit montserratrigall.es or contact us through the form, email or WhatsApp. It applies in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

• Controller: Montserrat Rigall i Corominas, a self-employed professional.
• Website: https://www.montserratrigall.es/.
• Privacy contact and rights requests: info@montserratrigall.es.

You can also use this address to request further information about the processing or the applicable safeguards.

2. Data processed and its source

Data is obtained directly from the data subject or generated technically during browsing:

• Proposal form: full name, email, event date or date status, context and confirmation that this policy has been read. Optional fields include organisation, telephone number, service or format, topic, objective, audience type, delivery mode, location and reference case.
• Email or WhatsApp: address or number, visible name or profile, message and any data or files you choose to provide.
• Technical data: IP address and request logs, date and time, browser, device, referring page and security incidents that may be processed by hosting and communications services.
• Functional preferences: language and temporary state needed to restore navigation or manage chat-widget notices.

No special-category data is requested. Please do not include health, political-opinion, biometric or other particularly sensitive data, or third-party data that you are not authorised to disclose.

3. Purposes and lawful bases

• Answering enquiries and maintaining the contact you requested: consent expressed by voluntarily sending the communication (Article 6(1)(a) GDPR).
• Preparing a proposal, checking availability or managing a possible engagement: steps taken at your request before entering into a contract and, where applicable, performance of that contract (Article 6(1)(b)).
• Meeting tax and accounting duties or valid requests from authorities: compliance with legal obligations (Article 6(1)(c)).
• Operating and protecting the site, preventing misuse and resolving incidents: the legitimate interest in maintaining a secure and available service (Article 6(1)(f)), without using form content for analytics.
• Remembering preferences and retaining functional browser state: providing the requested functionality and the legitimate interest in offering consistent navigation.
• Measuring use of the website: producing aggregated statistics about visits, pages, devices, sources and commercial interactions, only with the user’s prior consent (Article 6(1)(a) GDPR). Form and chat-widget content is not sent to analytics.

Withdrawal of consent does not affect the lawfulness of earlier processing or processing that must continue under another lawful basis.

4. Required data and consequences of not providing it

Fields marked as required are needed to understand and answer the request. If you do not provide them or do not confirm that you have read the privacy information, you will not be able to submit the form. All other fields are optional. There is no general legal obligation to contact us or provide data.

5. Recipients and processors

Data is not sold or disclosed to third parties for advertising. The following may access it only where necessary:

• Hostinger, as the contracted hosting group providing infrastructure, security and email under the account’s applicable contracting entity and data-processing addendum. It acts as processor for data hosted on the controller’s behalf.
• Email and technical-infrastructure providers, to receive the request, send the confirmation and reply. The form is processed on the server by contact.php and delivered to the configured mailbox; the site does not create a separate submissions database.
• Professional advisers, where needed to manage a relationship or claim and subject to confidentiality.
• Public authorities, courts or law-enforcement bodies, only where a law or valid request requires it.

If you choose to start a WhatsApp conversation, your number, profile and messages will also be processed by WhatsApp Ireland Limited under its privacy policy. This channel is optional: you may use the form or email instead.

Google Ireland Limited provides Google Tag Manager and Google Analytics 4 when analytics is accepted. It may receive browsing and device data needed to produce statistics, but the site does not send form content or identifiers entered in contact fields. See the Google Privacy Policy.

6. Processing location and international transfers

Website hosting, form processing and email are provided through Hostinger under the plan, contracting entity and technical region recorded in the account’s private documentation. This policy does not attribute an entity or data centre that has not been verified.

Hostinger and its subprocessors may process data in the United Kingdom or outside the European Economic Area where needed to provide the service. Its data-processing addendum provides that transfers to countries without an adequacy decision are covered by the European Commission standard contractual clauses or another mechanism permitted by the GDPR. See the Hostinger Privacy Policy and Data Processing Addendum, or request further information through the contact address.

If you voluntarily use WhatsApp or another external link, that provider may make transfers under the safeguards described in its policy.

Google may process information on servers outside the European Economic Area. Google states that it uses adequacy decisions, the EU-US Data Privacy Framework and, where applicable, standard contractual clauses. See its legal frameworks for data transfers.

7. Retention periods

• Enquiries or proposals that do not lead to a professional relationship: until resolved and for no longer than 12 months after the last relevant communication, unless retention is needed to establish, exercise or defend a legal claim.
• Contractual or professional relationship: while it remains active and afterwards for the applicable statutory limitation and tax, accounting or commercial record-retention periods.
• Messages received through the form and email copies: subject to the same criteria and to periodic review and deletion. The form does not create its own requests database.
• Hostinger logs, restricted records and backups: may remain for strictly necessary technical or legal periods under the hosting agreement and data-processing addendum.
• Technical and security logs: for the limited period the provider and controller need to provide the service, investigate incidents and comply with obligations. The form anti-abuse control stores only hashed identifiers and timestamps outside the public directory. Timestamps stop counting after the 15- or 60-minute windows end, and obsolete files older than 24 hours are deleted automatically when a later request is processed.
• Browser storage: local preferences remain until you delete them in your browser; session data disappears when the session ends or earlier if you clear it.

The analytics decision is stored with the date and this policy version for no more than 12 months, after which it is requested again. If you accept, the GA4 cookies _ga and _ga_ZFCFG03YMR have a default duration of up to two years, subject to browser limits. The GA4 property is configured to retain event data for 2 months and user data for 14 months; the latter period resets when new activity occurs.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability free of charge, and withdraw consent at any time. Email info@montserratrigall.es and state which right you wish to exercise.

Additional identity information will be requested only where there are reasonable doubts. Requests will normally be answered within one month, subject to the extensions allowed by the GDPR.

If you believe the processing breaches the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), preferably after first contacting the controller.

9. Automated decisions and profiling

No solely automated decision that produces legal or similarly significant effects is made, and no personal profile is created.

10. Cookies, local storage and analytics

The site uses Google Tag Manager under GTM-NRFHSHF6 and Google Analytics 4 under measurement ID G-ZFCFG03YMR in basic consent mode. Until you accept, Tag Manager is not downloaded, Google is not contacted and GA4 cookies are not set. Advertising storage, advertising user-data and advertising-personalisation permissions always remain denied.

If you accept, GA4 may use the first-party cookies _ga and _ga_ZFCFG03YMR to distinguish visits and retain session state. Enhanced measurement covers page views, scrolls, outbound clicks, internal searches, video interactions, downloads and form interactions, together with browser, device, source and approximate geographical location. Names, email addresses, telephone numbers, messages and form-field values are not transmitted.

Google Signals, user-provided data collection and Google Ads links are not enabled, and advertising personalisation is not used. The site’s custom commercial events are likewise sent only after acceptance.

You can accept or reject equally easily and change your choice at any time through “Cookie settings” in the footer. When consent is withdrawn, the state is updated, non-essential preferences are removed and the site attempts to remove GA4 cookies from the domain.

11. Security and confidentiality

Technical and organisational measures proportionate to the risk are used to prevent unauthorised access, alteration, loss or disclosure. Access is limited to the controller and providers that need the data to deliver the service. No Internet transmission is completely infallible; please report any incident to the contact address.

12. Children

The form is intended primarily for adults and professional contacts. Children under 14 must not submit data on the basis of their own consent without authorisation from a parent or legal guardian. Do not include data about children or other third parties unless you have a lawful basis to do so.

13. Third-party links and services

Links to social networks, media organisations or other websites do not transmit the form content. When you open them, you leave this site and the destination service applies its own terms and policies. Please review them before providing data.

14. Changes to this policy

This policy will be reviewed whenever the processing, providers or applicable law changes. The effective-version date appears above. If a change affects a purpose based on consent, fresh consent will be requested where legally required.