Privacy policy

In short

This site has no accounts, no logins and no newsletter. If you never use the contact form and refuse the consent banner, the only personal data involved is the IP address that any web server has to see in order to answer you at all, and the cookieless page-view signal described under counting readers. Everything below is the detailed version of that sentence.

Who the controller is

The controller is David Franco Aguirre, trading as GoRandom, Bilbao, Spain, reachable at [email protected]. Because the controller is established in the European Union, the General Data Protection Regulation applies to this processing; for readers in the United Kingdom the UK GDPR and the Data Protection Act 2018 apply alongside it. There is no data protection officer: the site is small enough that the controller answers these requests personally.

Each purpose, its lawful basis and how long it lasts

• Answering a message. The name, email address and text you type into the contact form, used for nothing but the reply. Lawful basis: your request, which is a contract-like step under Article 6(1)(b), together with our legitimate interest in keeping a record of what was asked. Deleted after twelve months.
• Keeping the site up and fending off abuse. IP address, user agent, the URL requested and the time of the request, logged by the hosting provider and by Cloudflare. Lawful basis: legitimate interests under Article 6(1)(f) — without this there is no defence against floods of automated requests. Rotated within weeks, never used to profile a reader.
• Counting readers. Google Analytics, pages viewed and coarse device information, with IP addresses truncated before storage. Lawful basis: your consent under Article 6(1)(a). Until you give it, no analytics cookie is written and Google receives only a cookieless signal that a page was viewed (Google Consent Mode), with no identifier linking it to you or to your other visits; full measurement starts when you accept and stops the moment you take it back.
• Selling the advertising that pays for all this. Google AdSense serves the ad slots. With consent, Google may use cookies and similar identifiers to choose ads for you and to cap how often you see one; without consent the slots still fill, but with ads chosen from the page rather than from you. Google explains its own side of this at how Google uses data from sites that use its services. Lawful basis: consent.

Sharing and transfers out of the UK

Nobody buys data from this site and nobody is sent it for their own purposes. Three categories of processor see it in the course of their work: the hosting provider, which keeps the server; Cloudflare, which delivers the pages and filters attacks; and Google, which serves the measurement and advertising code and may set or read its cookies only if you allowed that. Some of these companies operate infrastructure outside the United Kingdom and the European Economic Area. Those flows rest on the European Commission’s standard contractual clauses, on the UK Addendum to them or on the International Data Transfer Agreement, and on adequacy decisions where one exists for the country concerned.

Your rights under the UK GDPR

You may ask what is held about you and get a copy of it; have an inaccuracy corrected; have the data erased; restrict or object to processing that rests on legitimate interests; receive what you provided in a portable form; and withdraw consent for measurement or advertising at any moment, which costs nothing and changes nothing else. One email to [email protected] is enough, and no particular form of words is needed. We answer within one month.

Complaining to the ICO

If the answer is unsatisfactory you can complain to a supervisory authority without going through us first. Readers in the United Kingdom go to the Information Commissioner’s Office, ico.org.uk; readers elsewhere in the European Economic Area may approach their own national authority or the Spanish Agencia Española de Protección de Datos, aepd.es, where the controller is established.

Last updated: October 2026.