Privacy Policy

This Privacy Policy applies to the website at https://www.rominahoyos.com including all subpages, provided they refer to this notice.

It describes the processing of personal data in accordance with the principles of the GDPR (EU) and – where applicable – the UK GDPR as well as supplementary national provisions.

Personal data means any information relating to an identified or identifiable natural person (e.g. name, email address, IP address).

• Data minimisation: only as much as necessary.
• Purpose limitation: only for clear, legitimate purposes.
• Security: appropriate technical/organisational measures.
• Transparency: clear information & easy ways to contact us.

When you access the website, the server necessarily processes certain data to establish the connection, deliver the website and ensure security. In particular, the following may be processed:

• IP address (truncated or full, depending on the server setup)
• Date and time of access
• Requested page/file, status codes
• Amount of data transferred
• Referrer URL (previously visited page, if transmitted)
• Browser type/version, operating system, language settings

Purpose: operation of the website, stability, detection of abuse/attacks, error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation).

Retention period: Log data is generally stored only as long as required for the purposes (e.g. a few days to weeks) and then deleted or anonymised, unless security/legal reasons require longer storage.

The website is operated with a hosting service provider. The provider processes the technical data mentioned above on our behalf insofar as this is necessary to provide and operate the website.

Legal basis: Art. 6(1)(f) GDPR (secure operation) and, where applicable, Art. 28 GDPR (processing on behalf).

This website may embed content from external servers (e.g. background images, media files, libraries). When such content is retrieved, your IP address is technically transmitted to the respective provider, otherwise delivery would not be possible.

Purpose: appealing presentation and efficient delivery of content.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in professional presentation and performance).

If you do not want any transmission to third-party providers, we can technically adjust external content so that it is delivered entirely from our own server (where possible).

If you contact us (e.g. via email or WhatsApp), we process your information to handle your request and to answer any follow-up questions.

Data categories: contact details (e.g. name, email, phone number), communication content, metadata (time, possibly technical identifiers).
Purpose: handling and documenting enquiries, support, preparation/performance of contracts.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication).

Retention period: as long as necessary to handle the request; beyond that only if statutory retention obligations exist or for the defence of legal claims.

Note: When using WhatsApp, data may also be processed by the respective service provider. You can always use email instead if you prefer.

Cookies are small text files that can be stored on your device. This website may use technically necessary cookies, insofar as this is required for core functions (e.g. security, language settings, session handling).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional, secure operation) or – where required – Art. 6(1)(a) GDPR (consent), e.g. for optional marketing/tracking cookies.

On this website – unless we explicitly activate it – no personal tracking mechanisms for marketing purposes are required. If analytics/tracking tools are used in the future, this notice will be updated in advance and – if necessary – consent will be obtained.

We only share personal data where necessary, e.g. with:

• Hosting/IT service providers (operation, maintenance, security)
• Communication service providers (e.g. email, messenger – depending on your chosen contact channel)
• Authorities/courts where we are legally obliged to do so

If service providers process data on our behalf, this is done on the basis of a data processing agreement (Art. 28 GDPR), where required.

Depending on the service providers or communication channels used, processing may also take place outside the EU/EEA. In such cases, we ensure appropriate safeguards (e.g. Standard Contractual Clauses, additional protective measures), insofar as legally required.

We store personal data only for as long as necessary for the respective purposes or as required by law. Thereafter, data is deleted or anonymised, unless legitimate reasons (e.g. legal defence) prevent this.