Data protection
Privacy policy
Last updated: 19 August 2026
In one line: I use your data only to reply to you. I do not sell it, I do not pass it to third parties for commercial purposes, and I do not add you to any mailing list unless you ask.
1. Data controller
| Controller | Johannes Pablo Fallorina |
|---|---|
| Tax ID (NIF) | 51532702Y |
| Address | Calle Iriarte, 8 · 28028 Madrid, Spain |
| hola@jfallorina.es | |
| Phone | +34 654 806 991 |
Processing complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).
2. What data I process and why
| Source | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | Name, email, phone, area of interest and the content of your message | To answer your enquiry and, where applicable, prepare a quote | Your consent (Art. 6.1.a GDPR) |
| WhatsApp, phone or email | Whatever you choose to share in the conversation | To handle your request and maintain the thread of communication | Your consent and, if you are already a client, performance of the contract (Art. 6.1.b) |
| Browsing | IP address, date and time of access and browser type, logged by the server | Site security and abuse prevention | Legitimate interest in security (Art. 6.1.f) |
I do not process special categories of data (health, political opinions, religion, trade union membership, biometric data or sexual orientation). If, in the context of a nutrition or wellness service, you voluntarily share health information with me, it will be processed solely with your explicit consent and for the specific purpose you requested.
3. How long I keep your data
- Enquiries that do not lead to an engagement: up to one year from the last contact, unless you request earlier deletion.
- Clients: for the duration of the relationship and thereafter for the statutory limitation periods — six years for commercial documentation (Article 30 of the Spanish Commercial Code) and four years for tax obligations.
- Server logs: for the period set by the hosting provider, typically a maximum of twelve months.
4. Who I share your data with
I do not sell or transfer your data for commercial purposes. Only the providers necessary to deliver the service have access, each under a data processing agreement pursuant to Article 28 GDPR:
- Web hosting and email provider, which stores the messages you send me.
- WhatsApp (Meta Platforms Ireland Ltd.), if you choose that channel. When you message me on WhatsApp, your number and the content are additionally subject to Meta's privacy policy.
- Google Fonts (Google Ireland Ltd.), which receives your IP address when the site's typefaces load. You can prevent this by blocking external fonts in your browser.
If your enquiry relates to a service delivered by one of my brands, your data will be processed within that activity. Specifically for property intermediation, SAFTI España acts as controller or joint controller depending on the transaction, under its own privacy terms.
No international transfers take place outside the European Economic Area other than those inherent to the providers listed above, which operate under standard contractual clauses approved by the European Commission.
5. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions. You may also withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.
Write to hola@jfallorina.es stating the right you wish to exercise. I will respond within one month at the latest.
If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
6. Automated decisions
The property valuation and energy saving calculators produce automated estimates that are purely indicative. They have no legal effect, do not replace an official appraisal or professional study, and every material decision involves human judgement.
7. Minors
This site is not directed at children under 14 and I do not knowingly collect their data. If I find that I have received a minor's data without guardian authorisation, I will delete it.
8. Security
I apply reasonable technical and organisational measures to protect your data: encrypted HTTPS connection, restricted access to information and regular backups. No system is infallible, but I undertake to notify you of any security breach affecting your rights within the timeframes set by Article 34 GDPR.
9. Changes to this policy
I may update this policy to reflect regulatory or business changes. The date of the latest revision appears at the top of this page.
← Back to home