Privacy Policy

Last updated: 30.08.2026

This Privacy Policy explains how Paloma Consulting SL (“we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit johannapesonen.com (the “Website”) or contact us through the Website.

1. Data Controller

The controller responsible for processing your personal data is:

Paloma Consulting SL  

Registered address: CALLE LOS CAMACHOS 6, 29640 FUENGIROLA, MALAGA, SPAIN Company registration number: B56735103

2. Personal Data We Collect

Depending on how you use the Website, we may collect the following categories of personal data:
Information you provide to us

When you complete a contact form, send us an email, or otherwise communicate with us, we may collect:

your name;
email address;
telephone number;
company or organisation name;
information included in your message;
any other information you voluntarily provide.

Please do not submit confidential or sensitive personal information unless it is necessary for your enquiry.

Technical and usage data

When you visit the Website, certain technical information may be collected automatically, including:

IP address;
browser type and version;
device type and operating system;
pages visited and time spent on the Website;
referring website or source;
date and time of access;
diagnostic, security, and server log information;
cookie identifiers and similar technical data.

3. How and Why We Use Personal Data

We may process your personal data for the following purposes:

Responding to enquiries

We use the information submitted through our contact form or sent by email to respond to your questions, requests, or business enquiries.

The legal basis for this processing is our legitimate interest in communicating with Website visitors and potential customers. Where your enquiry concerns a possible contract, processing may also be necessary to take steps at your request before entering into a contract.

Operating and securing the Website

Technical information may be processed to:

operate and maintain the Website;
detect and prevent misuse, fraud, and security incidents;
diagnose technical problems;
protect our systems and business interests.

The legal basis is our legitimate interest in maintaining a secure, reliable, and properly functioning Website.

Website analytics

With your consent, we may use ANALYTICS PROVIDER, E.G. GOOGLE ANALYTICS to understand how visitors interact with the Website and to improve its content, structure, and performance.
Analytics cookies and similar technologies that are not strictly necessary will only be activated after you provide consent through our cookie banner or consent management tool. You may withdraw or change your consent at any time by using COOKIE SETTINGS LINK OR BUTTON.

Compliance with legal obligations

We may process or retain personal data where this is necessary to comply with applicable laws, regulations, court orders, or requests from authorised public authorities.

4. Cookies and Similar Technologies

The Website currently uses the following necessary cookies:

pll_language — used by Polylang to remember the language selected by the visitor.
cookieyes-* — used by CookieYes to store the visitor’s cookie consent preferences.

These cookies are necessary for the proper functioning of the Website and cookie consent management.
Strictly necessary cookies are used to provide essential Website functionality and do not normally require consent. Optional cookies, including analytics or marketing cookies, will only be used after you have provided consent where required by law.
You can accept, reject, or manage optional cookies through the cookie consent tool available on the Website. You can also configure your browser to block or delete cookies, although doing so may affect certain Website functions.
For more detailed information about the cookies used on this Website, please see our COOKIE POLICY / COOKIE SETTINGS.

5. Sharing of Personal Data

We do not sell your personal data.

We may share personal data with trusted service providers that help us operate the Website or conduct our business, including:

website hosting and infrastructure providers;
website maintenance and IT support providers;
email and communication service providers;
analytics providers;
professional advisers where necessary;
competent authorities where disclosure is required by law.

These service providers may process personal data only for the relevant service and in accordance with applicable data protection requirements.

6. International Data Transfers

Some service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we use an appropriate legal safeguard where required, such as:

a European Commission adequacy decision;
approved Standard Contractual Clauses;
another transfer mechanism recognised under applicable data protection law.

Information about the applicable safeguards may be requested using the contact details provided in this Privacy Policy.

7. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security, and reporting requirements.
Unless a longer period is required by law:

contact-form enquiries are generally retained for 24 months after the last communication;
technical server logs are generally retained for one month.

The appropriate retention period may depend on the nature of the information, the reason it was collected, and any applicable legal obligations.

8. Your Data Protection Rights

Subject to the conditions and limitations established by applicable law, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests;
receive certain personal data in a structured, commonly used, and machine-readable format;
withdraw consent at any time where processing is based on consent;
lodge a complaint with a competent data protection authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, contact us at Johanna@strand.es. We may need to request additional information to verify your identity before responding.
You may also submit a complaint to the data protection authority in the EU/EEA country where you live or work or where you believe a data protection infringement occurred.

9. Automated Decision-Making

We do not use personal data collected through this Website to make decisions based solely on automated processing that produce legal or similarly significant effects, unless explicitly stated otherwise.

10. Data Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction.
However, no method of transmitting or storing information online can be guaranteed to be completely secure.

11. Third-Party Websites

The Website may contain links to websites operated by third parties. We are not responsible for the privacy practices or content of those websites. We recommend reviewing the privacy policy of each third-party website you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy when our Website, services, or legal obligations change. The latest version will be published on this page, and the “Last updated” date will be revised accordingly.

13. Contact Us

If you have questions about this Privacy Policy or the processing of your personal data, please contact:

Paloma Consulting SL  

Email: Johanna@strand.es