Privacy Policy

Last updated July 21, 2026 | Version 2.0

This Privacy Policy explains how Alejandro Rojo Muñoz ("we," "us," or "our") processes personal data when you visit alerojo.com, request a newsletter subscription, receive our emails, contact us, or purchase a product or service.

We are established in Spain and act as the data controller for the processing described here, except where a provider acts as an independent controller for its own activities.

Rules for course and service purchases are set out in our Terms of Sale.

1. Personal data we collect

Newsletter requests and subscriptions

When you submit a newsletter form, we collect your email address, the source of the request, and records needed to show when and how the request was made. The request is sent to Moosend and initially remains pending.

We use double opt-in. Moosend sends a confirmation message to the address you provided, and you do not become a confirmed subscriber until you click its confirmation link. We may record the request, confirmation status, relevant timestamps, consent evidence, unsubscribe status, and technical delivery records. An unconfirmed address is not used to send the newsletter.

Email administration and engagement data

Moosend may generate records needed to deliver and administer emails, such as delivery, bounce, complaint, and unsubscribe information. If campaign interaction reporting is enabled, Moosend may also record opens, link clicks, dates, times, and related technical information. Email reporting is separate from the optional website analytics described below.

Contact and purchase data

If you contact us, we may collect your email address, name, message, and any information you choose to include. If you make a purchase, we may collect your name, email address, billing details, product, price, tax information, payment status, transaction identifiers, access records, and information needed to provide support or resolve a dispute.

Stripe processes card payments. We do not receive or store your full card number or card security code.

Technical and security data

Normal website hosting and security may generate an IP address, browser and device information, operating system, date and time, requested URL, referring URL, server logs, and diagnostic information. We do not use device GPS or similar technology to collect your precise physical location.

Optional website analytics

If you accept optional analytics, Moosend may collect page views, pages visited, dates and times, referring URLs, IP address, browser and device information, and browser, session, or website identifiers.

If you successfully submit a newsletter form after accepting analytics, the email address in that request may be sent in a Moosend identification event and associated with website activity. This can occur while the double opt-in request is still pending. More detail appears in the Cookie Policy below.

We do not purchase personal data from data brokers and do not intentionally collect special categories of personal data.

2. Required and optional information

Providing personal data is generally voluntary, but some information is necessary for a requested action:

• An email address and the required privacy confirmation are necessary to request a newsletter subscription. The double opt-in confirmation is necessary to complete it. Without them, we cannot add you as a confirmed subscriber.
• Analytics consent is optional. Rejecting it does not prevent browsing, subscribing, contacting us, or purchasing.
• Accurate contact, billing, and transaction information is necessary to process a purchase, deliver access, provide an invoice, or resolve a payment or access issue.
• You should not send a full card number, card security code, or personal data that is not needed for your request.

3. How and why we process personal data

The table below connects each activity with its data, purpose, legal basis, relevant providers, and retention approach.

Consent may be withdrawn at any time. Withdrawal does not affect processing that was lawful before it was withdrawn.

4. When and with whom we share personal data

We do not sell your personal data.

We may share personal data with trusted service providers where necessary to operate our website, communicate with subscribers, process payments, maintain business records, and provide our products and services.

Depending on the service involved, these providers may include:

Hostinger

We use Hostinger for website hosting, infrastructure, domain-related services, and related technical services.

Hostinger may process technical information and other personal data hosted or transmitted through the website to provide these services.

Moosend

We use Moosend, a Constant Contact company, for email marketing, subscriber management, email delivery, and, when you consent, optional website analytics.

Moosend may process information such as your email address, subscription information, email engagement information, and, where optional tracking has been accepted, website activity associated with your browser or subscriber profile.

Stripe

We use Stripe to process payments.

Stripe processes payment and transaction information necessary to provide its payment services. Depending on the specific processing activity, Stripe may act as a service provider acting on our behalf or as an independent data controller under applicable data protection law.

Google Workspace

We may use Google Workspace for business email, document storage, and communications.

If you communicate with us by email or if information relating to our business relationship is processed through these services, Google may process that information as part of providing its services to us.

Holded

We may use Holded for invoicing, accounting, and business administration.

Where necessary for these purposes, relevant customer, billing, invoice, and transaction information may be processed through Holded.

Not every service provider receives every category of personal data. Personal data is shared only where relevant to the service being provided.

We may also disclose personal data:

• To professional advisers where reasonably necessary, such as legal or accounting advisers.
• To public authorities, courts, regulators, or law enforcement authorities where required or permitted by law.
• In connection with the establishment, exercise, or defense of legal claims.
• In connection with a business reorganization, sale, transfer, merger, or similar transaction, subject to applicable law.

Our service providers may use subprocessors to provide their services.

5. International data transfers

We are established in Spain, but some of the service providers and subprocessors we use operate internationally.

As a result, personal data may be processed or stored in Spain, elsewhere in the European Economic Area ("EEA"), or in countries outside the EEA, including countries in which our service providers or their subprocessors operate.

Where personal data protected by the GDPR is transferred outside the EEA, we take steps to ensure that the transfer is carried out in accordance with applicable data protection law.

Depending on the recipient and destination country, this may include relying on:

• An adequacy decision adopted by the European Commission.
• The European Commission's Standard Contractual Clauses.
• The EU-U.S. Data Privacy Framework, where the recipient is eligible and certified.
• Another valid transfer mechanism permitted by applicable data protection law.

Where appropriate, additional safeguards may also be applied.

Our service providers may maintain their own international data transfer arrangements and contractual safeguards.

You may contact us at ale@alerojo.com if you would like more information about the safeguards applicable to a particular transfer of your personal data.

6. Retention schedule

• Unconfirmed newsletter requests: only while needed to complete or document the double opt-in request. These records are reviewed at least every six months and deleted when no longer necessary.
• Confirmed subscribers: until unsubscribe or withdrawal of consent. A limited suppression record and evidence of consent may be retained afterwards where needed to prevent further messages and demonstrate compliance.
• Website analytics: according to the shortest practical Moosend setting compatible with measurement, reviewed at least every six months. The browser preference itself lasts approximately 180 days.
• Customer access: for as long as necessary to provide the access promised in the applicable purchase terms.
• Commercial and accounting records: generally six years under Spanish commercial record-keeping rules. Tax information is generally subject to a four-year limitation period, but a longer period may apply where the law requires it or the period is interrupted.
• Messages and support records: until the matter is resolved and afterwards only for follow-up, compliance, or the applicable period for legal claims.
• Technical and security logs: for the shortest period reasonably necessary for security, fraud prevention, troubleshooting, or a specific legal obligation.

When data is no longer required, we delete or anonymize it where reasonably possible. It may remain temporarily in backups until those backups are overwritten under normal retention procedures.

7. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. No transmission or storage method can be guaranteed to be completely secure.

8. Children

Our website, newsletter, products, and services are not directed to children under 18 years of age.

We do not knowingly collect personal data from children under 18.

If you believe that a child has provided us with personal data, please contact us at ale@alerojo.com so that we can take appropriate action.

9. Your data protection rights

Under the GDPR, where applicable, you may request access, correction, deletion, restriction, or portability of your personal data; object to processing based on legitimate interests; withdraw consent; and lodge a complaint with a supervisory authority. You may object to direct marketing at any time.

Send a request to ale@alerojo.com. Exercising these rights is free unless a request is manifestly unfounded or excessive. We may ask for information reasonably necessary to verify your identity.

We normally respond within one month. Where permitted because a request is complex or numerous, that period may be extended by two additional months, and we will inform you of the extension within the first month.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

10. Marketing communications

You can unsubscribe at any time through the link in every marketing email or by contacting us. We may still send non-marketing messages needed to provide a purchase, respond to a request, manage a transaction, or comply with law.

11. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

12. Rights based on your location

Local law may give you additional privacy rights. Where that law applies to us, we will handle valid requests accordingly. We do not sell personal data or use it for targeted advertising. Contact ale@alerojo.com to make a privacy request.

13. Changes and versioning

We may update this policy when our business, providers, technology, or legal obligations change. We will identify the current version and date above. Where required, we will provide additional notice or request renewed consent before a material change to consent-based processing.

14. Contact

Cookie Policy

Last updated July 21, 2026 | Version 2.0

A cookie is a small piece of information stored by a browser. Similar technologies, including browser or session identifiers and tracking pixels, can perform related functions even when they are not technically cookies.

This website uses one strictly necessary preference cookie and may use optional Moosend website analytics only after consent. We do not currently use advertising or retargeting cookies.

1. Strictly necessary preference cookie

We use the first-party cookie alerojo_cookie_consent to remember whether optional analytics were accepted or rejected and which consent version applies.

This cookie does not measure website activity. It is stored to remember and respect the privacy choice you requested and may be used without consent where permitted by law.

2. Optional Moosend website analytics

Moosend website tracking loads only after you select Accept. It may record page views, measure website use, and, where applicable, associate activity with an email address submitted through a newsletter form.

Moosend's current public documentation describes its cookie-based technology by the categories of information stored rather than by fixed public cookie names and expiry periods. The technology may store:

Moosend does not publish stable names or fixed expiry periods for these identifier categories in its current public website-tracking documentation, and technical details may change. This description was reviewed on July 21, 2026. See Moosend's website tracking documentation and Moosend's Privacy Policy.

The legal basis for this optional tracking is consent. Rejecting it does not prevent browsing, newsletter signup, or purchases.

3. No advertising cookies

We do not currently use cookies for targeted advertising, cross-context behavioral advertising, retargeting, or selling personal data to advertisers. If that changes, we will update this policy and request consent where required before activating the technology.

4. Managing the choice

On your first visit, you can accept or reject optional analytics. The choice is remembered for approximately 180 days.

To choose again, delete the alerojo_cookie_consent cookie in your browser settings and reload or open another page. The notice will appear again. If Moosend had already loaded on the current page, reload or navigate away after deleting the preference so that no further tracking is initiated on that page.

You can also remove identifiers stored by Moosend through your browser settings. Deleting cookies may cause the website to ask for your preference again.

5. International processing

Moosend or its subprocessors may operate internationally. Where analytics data is transferred outside the EEA, the safeguards described in the International Data Transfers section above apply.

6. Changes to this Cookie Policy

We may update this policy if technologies, providers, purposes, or legal requirements change. If a change materially affects a previous consent, we will request a new choice where required.

7. Contact

Questions about cookies or similar technologies can be sent to ale@alerojo.com.