Privacy Policy
Complete translation of the Spanish original. Last updated: 30 October 2026.
1. Data controller
The controller is Monika Sieberichs, a sole trader (autónoma) operating the ALONPO brand. Address: Carrer dels Pins 17, 07610 Palma de Mallorca, Islas Baleares, España. Contact for privacy matters and requests to exercise your rights: [email protected]. This information is provided under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. Scope and information requested
This corporate website has no shop or customer account area. You do not have to provide a name or email address to browse it. An email address is necessary if you wish to receive the newsletter. Without it, you cannot subscribe, but you can still access the website. If you contact us by email, we process your address, the contents of your message and any information you choose to provide. Please avoid sending sensitive information that is not needed for your enquiry.
3. Hosting, connection data and security
The project is prepared for hosting and delivery through Cloudflare Pages. When you access the hosted version, Cloudflare necessarily receives your IP address and technical connection data, which may include the requested URL, date and time, browser, operating system and access errors. The purpose is to deliver content and maintain the service’s security and availability. The legal basis is the legitimate interest in operating and protecting the website (Article 6(1)(f) GDPR), balanced against visitors’ rights. This information is not used for behavioural advertising. The precise logging settings, retention periods and security features in the Cloudflare account still need to be verified before publication. This preview does not establish how the future alonpo.com configuration will behave.
4. Email contact
Messages to [email protected] and [email protected] are used to answer enquiries and manage discussions and collaborations. The legal basis is the legitimate interest in handling the communication (Article 6(1)(f) GDPR) or, where you request steps prior to entering into a contract, Article 6(1)(b) GDPR. Data is retained for as long as needed to handle the matter and subsequently only where a legal obligation applies or it is needed to establish, exercise or defend claims within the applicable time limits. Where required under the LOPDGDD, data will be retained in a blocked state and then deleted. The provider hosting these mailboxes and its processing terms must be confirmed before publication.
5. Newsletter and consent
The newsletter is managed through Brevo using the existing form hosted on sibforms.com. Its purpose is to send news about ALONPO, its ideas and next steps. The legal basis is your consent (Article 6(1)(a) GDPR and the LSSI-CE rules on commercial communications). Subscription is voluntary. The existing form is reused without changing its confirmation process. The operator states that double opt-in is used; its activation, settings and consent records could not be checked from the public interface. Your email address, consent and any technical data or confirmation records actually collected by Brevo are processed to manage and demonstrate the subscription. The service’s exact fields and records need to be confirmed in the account.
6. Unsubscribing, retention and withdrawal
You can unsubscribe using the link in each newsletter or by emailing [email protected]. Withdrawal does not affect the lawfulness of earlier processing. Subscription data is used while you remain subscribed; afterwards, only what is needed to demonstrate compliance, address liabilities and respect your objection by preventing further mailings is retained. The specific time limits and deletion of unconfirmed registrations must be checked in Brevo. Permission to load the form and a newsletter subscription are separate decisions: blocking the form does not cancel an existing subscription.
7. External form and storage
The Brevo form stays blocked until you authorise it to load. Once authorised, your browser connects to Brevo and shares at least your IP address and connection data, even if you do not submit the form. The legal basis for this optional loading is your consent. You can accept or decline using equivalent options and change your choice later under “Privacy settings” in the footer. Your choice to allow or block is saved for 180 days in localStorage on this device under the key alonpo.privacy.brevo.v1, together with the preference version and the saved and expiry timestamps. It contains no tracking ID. This first-party storage is used solely to remember and respect your requested setting, based on the legitimate interest in managing privacy preferences (Article 6(1)(f) GDPR). It is not used for analytics or advertising. Storage is technically necessary for that function and separate from permission for the external service. A saved permission lets you request the form again without another prompt; it does not load automatically when you visit the website. Once the choice expires or storage is cleared, you are asked again. If the browser prevents saving, your choice lasts only for the visit and a notice explains this. Withdrawal saves the choice to block and immediately removes the embedded form, including in other open tabs on the same origin that receive the storage change. It cannot reverse earlier connections or delete data on Brevo’s domain. Permission to load the form does not subscribe you to the newsletter. The link opening the form in a new window goes directly to Brevo, where the provider’s own privacy choices are managed separately.
8. Cookies, tracking and social networks
The website’s own code does not include Google Analytics, Meta Pixel, advertising, remotely loaded fonts or social media widgets. It sets no first-party cookies. It uses localStorage only for the technical Brevo preference described above; sessionStorage is not used. The language choice is part of the URL and is not saved in browser storage. The public Brevo form loads the script https://sibforms.com/forms/end-form/build/main.js. A full inspection of all cookies, possible HttpOnly cookies or storage on Brevo’s domain, and the future Cloudflare production features has not been completed. Cookie names that have not been observed are not presented as being in use. Instagram, Facebook and LinkedIn links do not load those services within this website. If you open a link, the platform receives connection data and applies its own privacy policy. Email open and click tracking in the Brevo account could not be verified; it must be checked before the first mailing and, if used, disclosed and supported by the required legal basis and consents.
9. Recipients and processors
Cloudflare is involved in hosting and delivering the website; Brevo is involved in the form and newsletter delivery. The operator’s email provider, which remains to be identified, also processes email communications. To the extent these providers act on the operator’s behalf, appropriate agreements under Article 28 GDPR must be in place. The existence and versions of these agreements in the accounts have not been checked. Data is not sold or disclosed for other companies’ advertising. Authorities may also receive data where required by law.
10. Locations and international transfers
We do not claim that all data is stored exclusively in Spain or the European Economic Area. Actual locations, access from third countries and subprocessors depend on the services and contracts of Cloudflare, Brevo and the email provider. Their current contractual documents and the accounts’ specific terms could not be verified in this review. Before publication, the operator must confirm the contracting entities, locations, subprocessors and, for transfers outside the EEA, the applicable Chapter V GDPR mechanism: for example, a valid adequacy decision or standard contractual clauses with any necessary supplementary measures. No particular provider or transfer is assumed to be covered by one of these mechanisms. You can request information and a copy of the applicable safeguards from [email protected].
11. Your rights and complaints
You can request access, rectification, erasure and restriction of processing. You can object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Data portability applies where its legal requirements are met, particularly for automated processing based on consent or contract. You can withdraw consent at any time. Explain your request in an email to [email protected] or write to the postal address above. Additional identification will only be requested where there are reasonable doubts and only to a proportionate extent. Requests are generally answered within one month; complex cases may be extended under the GDPR, with notice to you. You can complain to the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD): https://www.aepd.es/.
12. Automated decisions, changes and outstanding checks
The website’s own code does not profile visitors or make automated decisions with legal or similarly significant effects on them. The German and English versions are translations of the Spanish original and do not limit rights under applicable law. This information will be updated if processing changes. The expressly identified checks remain outstanding before publication: Cloudflare settings, the email provider, provider contracts and transfers, Brevo records and retention periods, double opt-in and email tracking. These checks are not represented as completed.