Privacy Policy

Last updated 5 November 2026

1. Who is responsible for your data?

Francisca Prieto Fernández, trading as Panchita Prieto, is responsible for the processing described in this notice. For privacy questions, email francisca@panchitaprieto.com.

2. What data is processed and why?

Website hosting and security

This website is hosted by Squarespace. When you visit, Squarespace processes technical information such as your IP address, browser and device details, the pages requested, and the time of access. This helps deliver and protect the website. The legal basis is my legitimate interest in operating a secure website (Article 6(1)(f) GDPR). Squarespace and its service providers may process data outside the EEA, including in the United States, under the transfer mechanisms and safeguards described in the Squarespace Data Processing Addendum.

Cookies and website statistics

Essential cookies support site functions and remember your cookie choices. Optional analytics cookies help me understand which pages people visit and improve the site. The legal basis for optional analytics cookies and related personal data processing is your consent (§ 25(1) TDDDG and Article 6(1)(a) GDPR). You can decline optional cookies or change your choice later using the Cookies control. I do not use visitor information for direct marketing or targeted advertising.

Contact by email

If you email me, I use your email address and the information you share to reply and handle your enquiry. The legal basis is taking steps at your request before a contract, where applicable (Article 6(1)(b) GDPR), or my legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). My email provider processes this correspondence. You decide what to include, but I need enough information to respond.

Contact form

If you use the contact form, I use your name, email address, subject and message to respond to your enquiry. The same legal bases described for email enquiries apply. Squarespace processes the submission, stores it in the site account and sends a copy to my business inbox. Squarespace keeps submissions with a required email field until I delete the submission or the associated contact. I keep these records only as long as needed to handle the enquiry or project, or longer where legal retention obligations or legal claims require it.

3. How long is data kept?

Squarespace’s visitor Activity Log, when enabled, shows individual visits for seven days. Aggregate traffic reports may remain available longer. This seven-day period applies to the Activity Log. Hosting and security data are retained as needed to operate and protect the website. Enquiry emails are kept as long as needed to handle the enquiry or project, or longer where legal retention obligations or legal claims require it.

4. Your rights

Under the GDPR, you may request access to your personal data, correction, deletion, restriction, or portability where applicable. You may object to processing based on legitimate interests. You can withdraw consent at any time for future processing. You may also lodge a complaint with a supervisory authority, such as the Lower Saxony data protection authority.