Privacy Policy
We care about your privacy and want you to understand how personal data is collected and used on this website. This Privacy Policy explains what information may be collected when you visit the site, contact Haizea Arratibel García, or request professional information such as her CV, and how that information is handled.
Please read this page carefully so you know how your personal data is processed.
Using this website does not mean that you must provide personal data. However, if you contact us through a form, by email, or by any other direct means, your data will be processed in accordance with this Privacy Policy.
1. Who is responsible for this website
The data controller for this website is:
Haizea Arratibel García
Website: https://haizea-arratibel.es/
Email: haizea.arratibel@gmail.com
This website has been developed with the intention of complying with applicable data protection rules, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and, where applicable, Spanish data protection rules. The GDPR is the core EU legal framework for personal data protection.
You are responsible for ensuring that any personal data you submit is accurate, up to date, and does not infringe the rights of third parties.
2. What personal data may be collected
Depending on how you interact with the website, the following personal data may be processed:
- Identification and contact details, such as your name, company name, email address, telephone number, or any information you include in your message
- Professional information you voluntarily provide when discussing a project, collaboration, tender, or CV request
- Technical data related to the use of the website, such as IP address, browser type, device information, and basic usage data, where this is necessary for security, performance, or analytics tools that may be active on the site
- Any information you choose to send by email or through contact forms
No special category personal data should be sent through this website unless strictly necessary and expressly requested.
3. Why your data may be used
Personal data may be used for the following purposes:
a) To respond to enquiries
If you contact Haizea Arratibel García through a form or by email, your data will be used to respond to your request, message, or enquiry.
b) To manage professional opportunities and requests
If you request a CV, a professional profile, project information, or contact for a collaboration, your data may be used to manage that request and continue the related professional communication.
c) To maintain website security and performance
Certain technical data may be processed to keep the website secure, functioning properly, and protected against misuse.
d) To comply with legal obligations
Your data may be processed when necessary to comply with applicable legal, regulatory, or administrative obligations.
e) To improve the website and user experience
If analytics or performance tools are enabled, limited usage data may be used to understand how the website is used and to improve its content and functionality. If cookies are used for this purpose, this should be reflected in the Cookies Policy and, where required, managed through consent tools.
4. Legal basis for processing
Personal data is processed on one or more of the following legal bases recognised under the GDPR:
- Your consent, when you voluntarily submit a contact form, request information, or otherwise agree to specific processing
- Pre-contractual steps, when the processing is necessary to respond to a request related to a potential professional collaboration, project, or service
- Legitimate interests, for example to maintain website security, prevent abuse, and manage normal professional communications, provided those interests do not override your rights and freedoms
- Legal obligations, where processing is required by law
Under EU rules, organisations must identify a valid legal basis for each processing activity, and legitimate interest can only be used when the relevant conditions are met.
5. Who may receive your data
Personal data will not be sold to third parties.
However, data may be shared, where necessary, with service providers that support the operation of the website or professional communications, such as:
- Hosting providers
- Website maintenance or technical support providers
- Email or contact-form service providers
- Security, backup, or anti-spam providers
- Public authorities, courts, or regulators where disclosure is legally required
These providers will only have access to the data strictly necessary for the relevant service and must handle it under appropriate confidentiality and data protection obligations.
6. International data transfers
Some technical or communication providers may process data outside the European Economic Area. If that happens, any transfer should be covered by an appropriate lawful transfer mechanism under EU data protection law, such as an adequacy decision or appropriate safeguards like standard contractual clauses. EU rules require safeguards when personal data is transferred to third countries.
If you later add third-party tools based outside the EEA, this section should be updated to identify them properly.
7. How long data is kept
Personal data will be kept only for as long as necessary for the purpose for which it was collected and, where relevant, for the period required to comply with legal obligations or to deal with possible liabilities.
As a general rule:
- Contact enquiries will be kept for the time needed to reply and follow up appropriately
- Professional communications may be retained while there is a legitimate professional relationship or a reasonable expectation of continued contact
- Technical and security logs may be kept for the period reasonably necessary to maintain website integrity and investigate incidents
- Data subject to legal or regulatory obligations may be retained for the legally required period
Once the data is no longer necessary, it will be deleted or securely anonymised where appropriate.
8. Your rights
You may exercise your data protection rights at any time. Depending on the circumstances, these include the right to:
- access your personal data
- rectify inaccurate data
- request erasure
- request restriction of processing
- object to processing
- request portability, where applicable
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
Under EU data protection rules, controllers must facilitate the exercise of these rights and respond to valid requests.
To exercise your rights, you can write to:
Please include enough information to identify your request and, where necessary, proof of identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your data has been processed unlawfully.
9. Third-party links
This website may contain links to third-party websites, platforms, or social networks. Their privacy practices are governed by their own privacy policies, not by this one.
Before submitting personal data to any third-party website, you should review its privacy information.
10. Cookies
This website may use cookies or similar technologies to ensure proper functionality, improve performance, or analyse usage. Where required, cookie use should be managed through a dedicated Cookies Policy and consent mechanism.
Please refer to the Cookies Policy for more information.
11. Data security
Appropriate technical and organisational measures are applied to help protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. The GDPR requires controllers to implement measures appropriate to the nature, scope, context and purposes of the processing and the related risks.
However, no online system can guarantee absolute security.
12. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect legal, technical, or operational changes. The latest version published on this website will apply.
If significant changes are made, they will be reflected on this page.
Last updated: 9 July 2026