Privacy policy
Last updated: 16 October 2026
This policy explains what we do with your personal data when you use limeralda.com, under the General Data Protection Regulation (GDPR) and Spanish data protection law. Each section says what the data is, why we use it and for how long.
Who is responsible
- Controller: Kevin León, self-employed, trade name Limeralda.
- Details: Kevin Daniel León Jouvin, NIF Z3714124-C, Calle de Diego de León 13, 7º A, 28006 Madrid, Spain (legal notice).
- Contact for data matters: kevin@limeralda.com.
What data we process, why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your message from the contact form or an email | Name, email, topic and message | Pre-contractual steps at your request (art. 6.1.b GDPR) | While we handle your enquiry. Afterwards, blocked while liabilities may still arise |
| Course waitlist and news by email | Email and, if you give it, name | Your consent (art. 6.1.a GDPR) and art. 21 of the LSSI, which requires you to ask for or authorise these emails | Until you withdraw your consent or unsubscribe |
| Being able to prove you gave consent | Date and time, page, the exact text you accepted and a hash of your browser | Legitimate interest in proving consent, which art. 7.1 GDPR requires us to be able to do (art. 6.1.f) | While we keep your record. Afterwards, blocked while liabilities may still arise |
| Preventing spam and automated submissions on the forms | A Cloudflare Turnstile check and a hash of your IP address | Legitimate interest in protecting the form (art. 6.1.f) | The IP hash is deleted after an hour, the next time anyone uses the form |
| Visit statistics with Google Analytics 4 | Cookie identifier, pages viewed, device and browser type, approximate country or city | Your consent (art. 6.1.a GDPR and art. 22.2 LSSI) | Cookies: 2 years at most (cookie table). Data retention in Google Analytics is set in Limeralda's property |
| Cookieless visit measurement with Cloudflare Web Analytics, once switched on | Aggregated visit data, with no cookies or storage on your device | Legitimate interest in knowing which pages are read (art. 6.1.f) | As set in Cloudflare Web Analytics |
| Measuring Google Ads, once there are campaigns | Ad cookies, click identifier and conversions (a message or a request). With your advertising consent, Google may receive your email in hashed form to match the conversion | Your consent (art. 6.1.a GDPR and art. 22.2 LSSI) | Cookies: 90 days, and 13 months for the IDE cookie (cookie table) |
| Charging for a service, only if you pay | Stripe processes the payment details. We receive the payment notice, the amount and your email | Performance of a contract (art. 6.1.b GDPR) | As long as accounting and tax obligations require |
We do not sell your data. We make no automated decisions about you. For analytics and advertising we load Google scripts only after you accept them, and if you reject them nothing is sent to Google.
Who else sees your data
We use these providers to run the service. They act on our behalf unless stated otherwise.
- Cloudflare: hosts the website, runs the form, checks that the sender is a person (Turnstile), measures visits without cookies (Web Analytics) and stores messages, waitlist and news sign-ups in its D1 database.
- Google: Google Analytics 4 and Google Ads, only if you accept them.
- Stripe: only if you pay for a service.
- Brevo: the email tool for news. It is not active yet; when it is, we will say so here before sending anything.
We do not pass your data to anyone else unless a law requires it.
Transfers outside the European Union
Cloudflare, Google and Stripe are based in the United States, so some data may be processed there.
- Cloudflare states on its GDPR page that it relies on its certification under the EU-U.S. Data Privacy Framework and that, if that certification lapsed, it applies the European Commission's standard contractual clauses.
- Stripe states in its privacy centre that it is certified under the same framework and may rely on the standard contractual clauses.
- For Google, the safeguards Google lists in its data processing terms for Analytics and Ads apply. We could not confirm its certification under the Data Privacy Framework, so we do not claim it.
As of 16 October 2026 the EU-U.S. Data Privacy Framework remains in force. The General Court dismissed the challenge against it on 3 September 2025 (case T-553/23) and the applicant appealed to the Court of Justice (case C-703/25 P), which has not ruled. If the framework fell, these companies would have to rely on other safeguards, and we would update this page.
Your rights
You can ask us at any time to:
- tell you what data of yours we process and give you a copy (access);
- correct wrong data (rectification);
- delete your data (erasure);
- stop using it in certain cases (objection and restriction);
- give it to you in a format another service can read (portability);
- withdraw a consent. Withdrawing is as easy as giving: for cookies, use the "Cookie settings" link in the footer; for emails, use the unsubscribe link in each email or write to us.
Write to kevin@limeralda.com saying what you want. We reply within the period the law sets, which is one month. Withdrawing consent does not affect what we did before you withdrew it.
If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (aepd.es). We would rather you write to us first so we can fix it.
Changes to this policy
If we change something that affects you, we update the date above. If the use of a cookie or a provider that needs your consent changes, we ask you again.