Legal information and privacy

The owner of zetesis.xyz and data controller is Rubén García Hernando, a sole trader with Spanish tax identification number (NIF) 79005724B, operating under the trading name Zetesis. My professional address is Calle Txabarri, 79, 3.º B, 48910 Sestao, Bizkaia, Spain.

You can write to ruben@zetesis.xyz about privacy or to exercise your rights. This policy covers the public zetesis.xyz website, its contact form and conversation bookings. Linked applications and services may have their own policies.

The form asks for your name, email and message; your company is optional. Messages are stored in the Zetesis management system to answer and follow up on your enquiry. If you write by email, I use your address and the information you include to reply.

When you request a proposal or information about engaging my services, the legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)). For other professional enquiries, including contact on behalf of a company, it is my legitimate interest in responding to communications addressed to my business (Article 6(1)(f)). You may object to the latter processing on grounds relating to your particular situation.

I need the required fields to handle your message and a valid address to reply. Please avoid including sensitive information or unnecessary data about other people. There is no newsletter: using the contact form does not subscribe you to a mailing list.

I use Cal.com to manage bookings. The calendar asks for your name, email, date and time, and allows notes and guests. I use this information to organise your requested conversation, on the same legal bases described for contact enquiries. The invitation may include a Google Meet link.

The calendar loads when you activate the booking button, not when you hover over or focus it. According to its policy, Cal.com processes booking data on behalf of the organiser and also collects technical, usage and diagnostic data to operate and protect its service. You can use email or the contact form without using the calendar.

I do not describe this website as “cookie-free”: opening the calendar may involve cookies and local storage from Cal.com and its providers. Observed mechanisms include NextAuth session and request-forgery protection, Cloudflare’s __cf_bm bot-protection cookie, and local storage for visual preferences and session coordination.

Cloudflare states that __cf_bm expires after 30 minutes of inactivity. You can manage or delete cookies and local storage in your browser; blocking necessary mechanisms may prevent booking from working.

The consent exemption is limited to technologies strictly necessary for a requested function. A session cookie is not automatically exempt. This policy does not extend that exemption to all third-party analytics or telemetry.

The website integrates Umami, served from analytics.zetesis.xyz, to view visit and page-performance statistics. Its documentation describes cookie-free measurement. These statistics help understand website use and detect operational problems; they are not used to subscribe you to marketing communications.

Hosting and other services involved in browsing may also process technical connection data, such as IP addresses and access logs, to deliver pages and protect the service. The legitimate interest in maintaining website availability and security is the basis for those purposes. The absence of cookies alone does not exempt all statistical processing from privacy rules.

Hosting, email, booking and video-call services help operate the website and communications. They may access the data needed to provide those functions. Data may also be disclosed to authorities where legally required.

Booking through Cal.com or using a Google video call may involve providers outside the European Economic Area. Cal.com reports processing in the United States and mechanisms such as standard contractual clauses or adequacy decisions, depending on the provider and transfer. Their policies and trust documentation explain these conditions. You can request information about providers and safeguards applicable to your data at ruben@zetesis.xyz.

I keep messages and booking data for as long as needed to handle your request and follow-up. Once no longer needed, they are due for deletion, except for data that must be retained with restricted access to address potential legal liabilities during the applicable periods.

If you engage my services, the data needed for that relationship is retained throughout its delivery and for the periods required by the relevant legal obligations. This criterion does not mean that the form has an automatic deletion mechanism.

You can request access, rectification and erasure, and exercise rights to object, restrict processing and data portability where applicable. Write to ruben@zetesis.xyz explaining your request. I will only ask for further identity verification where necessary.

Where processing relies on your consent, you can withdraw it without affecting the lawfulness of earlier processing. You can also lodge a complaint with the Spanish Data Protection Agency.

I will update this policy when the processing described changes. The date at the top identifies this version.