Privacy Policy

The controller responsible for the processing described below is:

Controller

Olha Mann (Leonis Resilience)

NIF

Y3724522P

Registered address

Carrer de Josep Irla, 10C, 08870 Sitges, Barcelona, Spain

Email

consulting@leonisresilience.com

Telephone

+34 674 666 098

This website has no contact form, no account system and no newsletter. We do not collect personal data through the site itself. Personal data reaches us only when you choose to contact us directly.

Enquiry correspondence. If you write to us by email or call us, we process the identification and contact details you provide (typically your name, email address, telephone number, employer and role) together with the content of your message. Legal basis: Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract; and, where your enquiry does not lead to an engagement, Article 6(1)(f) GDPR, our legitimate interest in responding to and keeping a record of business enquiries.

Audience measurement. We use Vercel Web Analytics to understand aggregate traffic patterns. It is cookieless and does not create persistent identifiers or profiles. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in maintaining and improving the site. See our Cookie Policy for detail.

Server logs. Our hosting provider records technical data such as IP address, timestamp, requested URL and user agent to deliver the site and protect it against abuse. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in the security and availability of the service.

We do not carry out profiling or automated individual decision-making within the meaning of Article 22 GDPR, and we do not use your data to train machine-learning models.

We do not sell personal data and we do not share it for advertising purposes. We disclose it only to the service providers needed to operate our business, each acting as a processor under a written agreement pursuant to Article 28 GDPR:

• Vercel Inc. — website hosting, content delivery and cookieless analytics.
• Our email and office productivity provider — receiving and storing correspondence.
• Where legally required, our accountant or professional advisers, and the competent public authorities.

Some of our providers are established outside the European Economic Area or process data through infrastructure located there. Where that occurs, the transfer is protected by the European Commission’s Standard Contractual Clauses (Decision 2021/914) together with supplementary technical measures such as encryption in transit and at rest, or by an adequacy decision where one applies.

You may request a copy of the relevant transfer safeguards by writing to consulting@leonisresilience.com.

We keep personal data only for as long as necessary for the purpose it was collected:

• Enquiries that do not lead to an engagement: up to 12 months from our last exchange, then deleted.
• Client engagement records: for the duration of the engagement and then for 6 years, to meet the commercial record-keeping obligation under Article 30 of the Spanish Commercial Code. Records with tax relevance are kept for the periods required by the General Tax Law.
• Aggregate analytics: retained in non-identifying, aggregated form only.

Under Articles 15 to 22 GDPR you have the right to request access to your personal data, its rectification or erasure, restriction of processing, data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, write to consulting@leonisresilience.com, stating the right you wish to exercise. We may ask for proof of identity where necessary. We will respond within one month, extendable by two further months for complex requests.

If you believe your data protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, or through its electronic office at sedeagpd.gob.es. You may also contact us first and we will do our best to resolve the matter.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access control on a need-to-know basis, multi-factor authentication on business accounts, and regular review of our providers. No system is entirely immune from risk, but professional confidentiality is central to how this practice operates.

We may update this policy to reflect changes in our processing or in applicable law. The date at the top of this page indicates the current version. Material changes affecting your rights will be highlighted on this page.