Spanish Tax JournalSpanish tax law · Álvaro Crespo GarcíaSearch
Menu

Privacy policy

Data controller

Infrastructure. Visiting any website necessarily generates technical data (IP address, browser headers). The provider that hosts and delivers the site processes them to provide the service and mitigate abuse, on the basis of legitimate interest (art. 6(1)(f) GDPR).

Cookieless analytics. The site uses Umami Cloud to obtain aggregate usage statistics: page visited, approximate country, device type, referring page and four reading events (scroll depth, full read of an analysis, clicks on categories or topics, and language switching). Umami does not set cookies or access the visitor’s device. It receives the IP address transiently to derive the approximate country, but does not store it in the analytics records or assign persistent identifiers. The controller only has access to aggregate data, which do not allow any visitor to be identified. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in knowing which content is useful. See also the cookie policy.

No data are collected through forms and no profiles are built. If you write to us by email, we will process your data only to reply.

Recipients and international transfers

  • Cloudflare, Inc. (hosting and content delivery network), as processor. For transfers to the United States it relies on its certification under the EU-U.S. Data Privacy Framework and, alternatively, on standard contractual clauses.
  • Umami Software, Inc. (United States; Umami Cloud analytics), as processor. Its data processing agreement incorporates the European Commission’s standard contractual clauses for transfers outside the European Economic Area.

Data are not disclosed to third parties for their own purposes.

Retention

The providers’ technical logs are retained for the period they set for security and service operation; the controller does not extract or store copies. Umami statistics are aggregate and are kept for as long as they are useful to understand how the site is used. Emails are kept for as long as needed to handle the enquiry.

Rights

Access, rectification, erasure, restriction, portability and objection (arts. 15-22 GDPR). Requests to consultas@spanishtaxjournal.com. Complaint to the Spanish Data Protection Agency (AEPD) (https://www.aepd.es).

Last updated: 1 November 2026.