Privacy Policy

Last updated: 05/10/2026

1. Who is responsible for your data

Sandra Montesinos Zapata, operating under the trade name Datsimple, is the data controller for personal data collected through datsimple.ai.

Contact: 

You can write to me at the email address about anything in this policy, including to exercise the rights set out in section 7.

2. What data is collected

Data you provide directly

  • Contact form: your name, email address, the content of your message, and anything else you choose to include.

  • Appointment booking: your name, email address, telephone number where you provide it, time zone, and any notes you add when booking.

  • Correspondence: if you email me directly, I hold the message and your address.

Data collected automatically

  • Server logs kept by the website host: IP address, browser type and version, operating system, referring page, pages viewed, and the date and time of access.

  • Analytics identifiers set by cookies, where you have consented. See section 4.

I do not collect special categories of data such as health information, political opinions or religious beliefs. Please do not include such information in messages or booking notes.

This site is not directed at children under 16 and I do not knowingly collect their data.

3. Why your data is processed, and on what legal basis

PurposeLegal basis (GDPR Art. 6)RetentionReplying to enquiries sent through the contact form or by emailArt. 6(1)(b) — steps taken at your request before entering a contract; or Art. 6(1)(f) legitimate interest in replying to correspondence where no engagement follows12 months from our last exchange, where no engagement followsScheduling, confirming and reminding you of appointmentsArt. 6(1)(b) — performance of a contract or steps prior to it12 months after the appointment, unless it becomes part of an engagement recordManaging a professional engagement, issuing and recording invoicesArt. 6(1)(b) — performance of a contract; Art. 6(1)(c) — legal obligation under Spanish tax and commercial lawDuration of the engagement, then 6 years under art. 30 Código de Comercio; tax records for 4 years under the Ley General TributariaMeasuring how the site is used, through Squarespace Analytics and Google Analytics 4Art. 6(1)(a) — your consentSee section 4Displaying embedded third-party content such as videos, maps and booking widgetsArt. 6(1)(a) — your consentSet by the provider concernedKeeping the site secure, diagnosing errors and preventing abuseArt. 6(1)(f) — legitimate interest in a functioning, secure siteAs set by the hosting provider

Providing your data through the contact or booking forms is voluntary, but without it I cannot reply to you or arrange an appointment.

4. Cookies and analytics

Essential cookies are needed for the site to work and to protect it against cross-site request forgery. These are set on the basis of legitimate interest and do not require consent. They include Squarespace's crumb security cookie, the cookie recording your own cookie preferences, and session cookies used by the booking function.

Everything below is set only after you consent through the cookie banner:

Squarespace Analytics — first-party cookies (ss_cid, ss_cvisit, ss_cvr, ss_cvt) measuring visits and how the site is used. Lifetimes range from the browsing session up to two years.

Google Analytics 4 — cookies (_ga, _ga_*) measuring audience and site performance. Google Analytics 4 does not log or store IP addresses, and data from visitors in the EEA is collected through EU-based servers. Event-level data is retained for 14 months. Google Signals and Google Ads data sharing are disabled on this property.

Embedded content — pages containing embedded videos, maps or scheduling widgets load content from the provider concerned, which may set its own cookies and receive your IP address. These embeds do not load until you consent.

You can change or withdraw your cookie consent at any time using the "Manage cookies" link in the site footer, and you can delete existing cookies through your browser settings. Withdrawing consent does not affect processing carried out beforehand.

Full details are in the Cookie Policy.

5. Who receives your data

The following providers process personal data on my instructions, under contracts meeting Art. 28 GDPR:

Squarespace Ireland Limited — Le Pole House, Ship Street Great, Dublin 8, Ireland. Website hosting, contact form submissions, appointment scheduling, and built-in analytics. Squarespace, Inc. (United States) acts as a sub-processor.

Google Ireland Limited — Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4. Google LLC (United States) acts as a sub-processor and hosting of email correspondence.

Where you view embedded content, the provider concerned receives your IP address and acts under its own privacy policy. Depending on the page, this may include YouTube, Vimeo, Google Maps or Calendly.

Beyond these, I disclose personal data only where required by law, or to public authorities, courts and tax administrations exercising their legal powers. I do not sell personal data and I do not share it for third-party advertising.

6. International data transfers

Some providers listed above transfer personal data outside the European Economic Area, principally to the United States.

Squarespace relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for visitors in the United Kingdom, the ICO's International Data Transfer Addendum.

Google relies on the European Commission's adequacy decision of 10 July 2023, as Google LLC is certified under the EU–US Data Privacy Framework and its UK Extension. Standard Contractual Clauses apply as a supplementary safeguard.

You may request a copy of the relevant safeguards by writing to sandra@datsimple.ai.

7. Your rights

You have the right to:

  • Access the personal data I hold about you and receive a copy

  • Rectify data that is inaccurate or incomplete

  • Erase your data

  • Restrict processing in certain circumstances

  • Portability — receive your data in a structured, commonly used, machine-readable format

  • Object to processing based on legitimate interest

  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Write to sandra@datsimple.ai to exercise any of these. You will receive a response within one month. Where a request is complex we may extend this by two further months, and will tell you within the first month if so.

If you are not satisfied with my response, you may complain to a supervisory authority:

  • Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es

  • United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF — www.ico.org.uk

  • Or the supervisory authority where you live or work in the EU

8. Automated decision-making

Datsimple does not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

9. Security

The site is served over HTTPS. Access to form submissions, booking records and analytics accounts is protected by unique credentials and two-factor authentication. Datsimple keeps personal data no longer than the periods set out in section 3, after which it is deleted or anonymised.

10. Changes to this policy

Datsimple may update this policy to reflect changes to the site, the services behind it, or the law. The date at the top shows when it was last revised, and material changes will be signalled on the site.