Privacy policy

What data we collect and what for

We only process the data you give us. We do not use any other source.

· Contact form and “request information” form: your first name, your surnames, your email, your phone number if you provide it and your question. We use them to reply to you.

· Commercial communications: only if you tick their checkbox, which is separate and not required to write to us. We use your name and email to send you news about the books, the training programmes and the processes. You can unsubscribe whenever you like.

· Request for a process: your first name, your surnames, your email, your phone number and your country; the situation that leads you to request it, how it affects you and what you would like to change; whether you have previously done any process or training; which format you are interested in; your availability for the sessions and anything else you wish to add. We use them to assess the process with you, contact you and, if you decide to start, organise it. Payment is made afterwards, on the payment page of our CRM (see “Who else sees them”), which stores the purchase data.

· Booking the free conversation: this is done in our CRM's calendar, which asks for your name, email and phone number to give you the appointment and remind you of it.

· Training programmes: registration is done on our CRM's pages (info.setuguia.com).

· Visit tracking: only if you accept it in the cookie notice, our CRM records which pages you visit and, if you write to us or request a process, links them to your request.

The contact form does not ask you to tell us anything about your health or your personal situation, and we ask you not to do so: that is discussed, if you wish, in the conversation. The request for a process does ask about your situation (see the next section).

No automated decisions affecting you are made.

Specially protected data

In a personal process, emotions, experiences and sometimes health are discussed. The law considers this data a special category (article 9 of the General Data Protection Regulation, GDPR), and we only process it with your explicit consent, which is requested separately, with its own checkbox, in the request for a process. Without that checkbox the request cannot be sent; if you prefer not to put anything in writing, you can book the free conversation.

This website does not store what is discussed in the sessions.

Notes are taken during the sessions and kept in the diary for two years.

You can withdraw that consent whenever you like by writing to the email address above.

Why we may process it

Messages: your consent, which you give by ticking the checkbox (article 6.1.a of the Regulation).

Commercial communications: your consent, with its own checkbox (article 6.1.a). You can withdraw it whenever you like.

Request for and contracting of a process, and purchases: your consent, the pre-contractual steps you ask us to take and the performance of the contract you enter into with us (article 6.1.b), and compliance with legal, accounting and tax obligations (article 6.1.c).

Special category data in the processes: your explicit consent (article 9.2.a).

Visit tracking: your consent in the cookie notice.

With each message or request, the date and the checkboxes you ticked are stored: this is the proof of your consent.

How long we keep it

Messages and process requests received through this website are deleted twelve months after they arrive, unless you start a process.

If you do a process, your data is kept for as long as it lasts. Once it ends, it is kept blocked, without being used in any way, for as long as it may be needed to deal with possible claims or legal liabilities.

If you accepted commercial communications, your name and email are kept for that purpose until you unsubscribe.

Purchase data is kept for six years, because the law requires accounting records to be kept (article 30 of the Spanish Commercial Code).

Notification and confirmation emails also remain in our mailbox and in yours.

Database backups are kept for a maximum of twelve months and then destroyed.

If you ask us to delete your data sooner, we delete it, except for what the law requires us to keep.

Who else sees them

We do not sell or pass on data to third parties. There are, however, companies that provide services to us and process data on our behalf, as processors:

· Cloudflare: website hosting and network, the website photos and one of the backups.

· Render: the website's server, in Frankfurt (Germany).

· Supabase: the website's database, in the European Union.

· HighLevel (GoHighLevel / LeadConnector): our CRM. The contact and process request forms and the booking calendar are theirs; it stores messages, requests, contacts, bookings, training registrations, the follow-up of each person and, if you accept it, the tracking of your visits to the website; and payments are collected through its payment pages.

· Stripe: card payments, through HighLevel's payment pages. Your card details never reach this website.

· Resend: sending notification and confirmation emails.

· Backblaze: backups.

· TUGESTO: accounting, invoicing and data protection advice.

· Sentry: logging of the website's technical errors, in the European Union. It is configured not to receive the content of the forms.

· Umami: visit measurement, only if you accept it (see the cookie policy), with the data stored in the European Union (Ireland).

HighLevel, Resend and Backblaze process data in the United States; Stripe and Cloudflare may process it outside the European Economic Area. Where there is an international transfer, it is carried out with the safeguards required by the Regulation: the standard contractual clauses approved by the European Commission and, where the company has signed up to it, the EU-U.S. Data Privacy Framework.

The community (clubsetuguia.com) is a separate platform, with its own login.

What you can do with your data

You can ask us at any time to access it, rectify it, erase it, restrict its use, object to its processing or receive it in a format you can take elsewhere. You can also withdraw your consent whenever you like, without affecting what was done up to that point.

Just write to the email address shown above, stating what you want. If we need to verify that it is you, we will ask you to. We reply within a maximum of one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

How we protect the information

The website is encrypted (HTTPS). Messages, requests and purchases can only be seen by the team members with access to our CRM and to the management panel, which are password-protected; the database cannot be accessed from the internet by anyone else.

Minors

The forms and purchases are intended for adults. If we detect data belonging to a minor without the authorisation of their parents or guardians, we delete it.

Changes to this policy

If the way we process data changes, we update this page and its date.