Privacy.
Last updated 6 September 2026
1. Who is responsible
Sean Johns, Fractional IT Director, Barcelona, Spain ([LEGAL ENTITY AND VAT]) is the data controller for this website, seanjohns.com. Contact: sean@seanjohns.com.
This policy follows the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).
2. What is collected, and why
- Enquiries. Name, email, company, headcount, what triggered the enquiry, and your message. Purpose: to reply and, if you ask, to prepare a proposal. Legal basis: steps prior to a contract (Art. 6(1)(b)).
- Call bookings. The same fields plus the time you chose. Purpose: to hold the call and send the invite. Legal basis: Art. 6(1)(b).
- Newsletter. Your email and where you signed up. Purpose: occasional notes, no more than monthly. Legal basis: consent (Art. 6(1)(a)), withdrawn by the unsubscribe link in every email.
- Server logs. A salted hash of your IP address is kept alongside form submissions for rate limiting. It cannot be reversed to your address. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f)).
Nothing else is collected. There are no accounts, no payments on this site, and no profiling.
3. Cookies and analytics
This site sets no cookies. Traffic is measured with Vercel Web Analytics, which is cookieless and does not identify visitors, so no consent banner is shown. There is no advertising or cross-site tracking.
4. Who processes the data
- Vercel (hosting, edge network, analytics) — Vercel Inc., USA, under EU Standard Contractual Clauses.
- Supabase (database) — hosted in Frankfurt, Germany (AWS eu-central-1).
- Resend (transactional email and the newsletter) — sending from Ireland (AWS eu-west-1).
- Google Workspace (calendar invites and Google Meet for booked calls; the mailbox behind sean@seanjohns.com) — Google Ireland Ltd.
No data is sold or shared with anyone else.
5. Retention
- Enquiries and bookings: 24 months after the last contact, or for the life of a client relationship plus the statutory period for commercial records.
- Newsletter: until you unsubscribe. Unsubscribed addresses are kept only on a suppression list so you are not emailed again.
- Rate-limit hashes: 30 days.
6. Your rights
Access, rectification, erasure, restriction, portability and objection, plus withdrawal of consent at any time. Email sean@seanjohns.com; expect a reply within one business day and a resolution within one month. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or your local authority.
7. Security
Traffic is TLS-only with HSTS. Database tables are not reachable with public keys; only server-side code holds the key that can read or write them. Transactional email is authenticated with SPF, DKIM and DMARC.
8. Changes
Changes are posted here with a new date. Material changes to how newsletter data is used will be announced in the newsletter itself.