Privacy policy

Last updated: 2 August 2026.

This policy explains how personal data is processed when you visit montserratrigall.es or contact us through the form, email or WhatsApp. It applies in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

• Controller: Montserrat Rigall i Corominas.
• Website: https://www.montserratrigall.es/.
• Privacy contact and rights requests: info@montserratrigall.es.

You can also use this address to request further information about the processing or the applicable safeguards.

2. Data processed and its source

Data is obtained directly from the data subject or generated technically during browsing:

• Proposal form: full name, email, event date or date status, context and confirmation that this policy has been read. Optional fields include organisation, telephone number, service or format, topic, objective, audience type, delivery mode, location and reference case.
• Email or WhatsApp: address or number, visible name or profile, message and any data or files you choose to provide.
• Technical data: IP address and request logs, date and time, browser, device, referring page and security incidents that may be processed by hosting and communications services.
• Functional preferences: language and temporary state needed to restore navigation or manage chat-widget notices.

No special-category data is requested. Please do not include health, political-opinion, biometric or other particularly sensitive data, or third-party data that you are not authorised to disclose.

3. Purposes and lawful bases

• Answering enquiries and maintaining the contact you requested: consent expressed by voluntarily sending the communication (Article 6(1)(a) GDPR).
• Preparing a proposal, checking availability or managing a possible engagement: steps taken at your request before entering into a contract and, where applicable, performance of that contract (Article 6(1)(b)).
• Meeting tax and accounting duties or valid requests from authorities: compliance with legal obligations (Article 6(1)(c)).
• Operating and protecting the site, preventing misuse and resolving incidents: the legitimate interest in maintaining a secure and available service (Article 6(1)(f)), without using form content for analytics.
• Remembering preferences and retaining functional browser state: providing the requested functionality and the legitimate interest in offering consistent navigation. No external analytics provider is currently enabled.

Withdrawal of consent does not affect the lawfulness of earlier processing or processing that must continue under another lawful basis.

4. Required data and consequences of not providing it

Fields marked as required are needed to understand and answer the request. If you do not provide them or do not confirm that you have read the privacy information, you will not be able to submit the form. All other fields are optional. There is no general legal obligation to contact us or provide data.

5. Recipients and processors

Data is not sold or disclosed to third parties for advertising. The following may access it only where necessary:

• Hostinger International Ltd., a company established in Cyprus, as the hosting, infrastructure, security and, where contracted, email provider. It acts as processor for data hosted on the controller’s behalf.
• Email and technical-infrastructure providers, to receive the request, send the confirmation and reply. The form is processed on the server by contact.php and delivered to the configured mailbox; the site does not create a separate submissions database.
• Professional advisers, where needed to manage a relationship or claim and subject to confidentiality.
• Public authorities, courts or law-enforcement bodies, only where a law or valid request requires it.

If you choose to start a WhatsApp conversation, your number, profile and messages will also be processed by WhatsApp Ireland Limited under its privacy policy. This channel is optional: you may use the form or email instead.

6. Processing location and international transfers

For European Union customers, Hostinger identifies the contracting entity as Hostinger International Ltd., whose registered address is 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Cyprus is a member of the European Union. The primary location of the website files and form will be the data centre selected in the Hostinger hosting plan; European and non-European locations are available.

Hostinger and its subprocessors may process data in the United Kingdom or outside the European Economic Area where needed to provide the service. Its data-processing addendum provides that transfers to countries without an adequacy decision are covered by the European Commission standard contractual clauses or another mechanism permitted by the GDPR. See the Hostinger Privacy Policy, Data Processing Addendum and available server locations.

If you voluntarily use WhatsApp or another external link, that provider may make transfers under the safeguards described in its policy.

7. Retention periods

• Enquiries or proposals that do not lead to a professional relationship: until resolved and for no longer than 12 months after the last relevant communication, unless retention is needed to establish, exercise or defend a legal claim.
• Contractual or professional relationship: while it remains active and afterwards for the applicable statutory limitation and tax, accounting or commercial record-retention periods.
• Messages received through the form and email copies: subject to the same criteria and to periodic review and deletion. The form does not create its own requests database.
• Hostinger logs, restricted records and backups: may remain for strictly necessary technical or legal periods under the hosting agreement and data-processing addendum.
• Technical and security logs: for the limited period the provider and controller need to provide the service, investigate incidents and comply with obligations.
• Browser storage: local preferences remain until you delete them in your browser; session data disappears when the session ends or earlier if you clear it.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability free of charge, and withdraw consent at any time. Email info@montserratrigall.es and state which right you wish to exercise.

Additional identity information will be requested only where there are reasonable doubts. Requests will normally be answered within one month, subject to the extensions allowed by the GDPR.

If you believe the processing breaches the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), preferably after first contacting the controller.

9. Automated decisions and profiling

No solely automated decision that produces legal or similarly significant effects is made, and no personal profile is created.

10. Cookies, local storage and analytics

The site does not currently set advertising cookies or load an external analytics provider. It uses localStorage to remember the chosen language and sessionStorage for temporary functional state, such as restoring position after a language change or remembering chat-widget notices during the session.

The measurement module is configured as inactive: while it remains so, it does not transmit events or store A/B variants or campaign attribution. Messages typed into the chat widget are also not stored in localStorage or sessionStorage or sent to an external service.

You can clear browser storage in your browser settings; blocking it may prevent some preferences from being retained. If external analytics or another technology requiring consent is enabled in future, this information will be updated and prior consent will be requested where required.

11. Security and confidentiality

Technical and organisational measures proportionate to the risk are used to prevent unauthorised access, alteration, loss or disclosure. Access is limited to the controller and providers that need the data to deliver the service. No Internet transmission is completely infallible; please report any incident to the contact address.

12. Children

The form is intended primarily for adults and professional contacts. Children under 14 must not submit data on the basis of their own consent without authorisation from a parent or legal guardian. Do not include data about children or other third parties unless you have a lawful basis to do so.

13. Third-party links and services

Links to social networks, media organisations or other websites do not transmit the form content. When you open them, you leave this site and the destination service applies its own terms and policies. Please review them before providing data.

14. Changes to this policy

This policy will be reviewed whenever the processing, providers or applicable law changes. The effective-version date appears above. If a change affects a purpose based on consent, fresh consent will be requested where legally required.