Controller
The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR and Art. 4 LOPDGDD is:
- Company
- Therese Blau S.L.
- Address
- Carrer d'Ariel, 19, 07660 Cala d'Or, Illes Balears, España
- Represented by
- Dinah Zacher, Jürgen Zacher
- General requests
- info@thereseblau.com
- Data-protection requests
- info@thereseblau.com
What data we process
We only process the data we genuinely need for the purpose at hand, no more, no longer.
- Server logs. IP address, user agent, referrer and timestamp are processed temporarily by Cloudflare to ward off attacks and to keep the site available. Retention: 30 days at most.
- Contact form. Name, email, company and message. Processed via Formspark and forwarded to our inbox. Retention: until your enquiry is closed plus statutory retention periods.
- ESG Checklist (lead magnet). Name, email, optionally company, plus your express consent. Processed via MailerLite. Retention: until you withdraw your consent.
- Language preference. First-party cookie
tb-localestoring your chosen language (de, en, es). Lifetime 12 months, technically necessary. - Audience measurement. Aggregated views, time on page and device class via Plausible Analytics, without cookies, without profiling, without cross-site tracking.
- Embedded map (contact page). When the contact page is opened, your IP address is transmitted to the OpenStreetMap Foundation so the map can be rendered. OpenStreetMap sets no cookies and performs no tracking. We load the map lazily (
loading="lazy"), so the request happens only once it scrolls into view.
Legal bases
- Art. 6 (1) (b) GDPR, pre-contractual and contractual contact (contact form).
- Art. 6 (1) (a) GDPR, consent (ESG Checklist, newsletter-style communication).
- Art. 6 (1) (f) GDPR, legitimate interest in security, fraud prevention and cookieless audience measurement.
- Art. 6 (1) (c) GDPR, compliance with statutory retention obligations.
Subprocessors and third parties
We work with carefully selected providers under data-processing agreements pursuant to Art. 28 GDPR. Any transfers to third countries take place exclusively on the basis of appropriate safeguards (EU Standard Contractual Clauses, Data Privacy Framework).
- Cloudflare, Inc., Hosting, CDN, DNS, bot and DDoS protection, edge functions. · Privacy
- MailerLite (UAB MailerLite), Delivery of the ESG Checklist and transactional emails (lead-magnet automation). · Privacy
- Formspark, Processing of contact-form submissions and forwarding to our inbox. · Privacy
- Plausible Analytics (Plausible Insights OÜ), Cookieless, aggregated traffic measurement without profiling. · Privacy
- Sanity.io, Headless CMS for blog content (no end-user data). · Privacy
- OpenStreetMap Foundation, Embedded interactive map showing our office on the contact page, no cookies, no profiling. · Privacy
Retention
We retain personal data only for as long as necessary for the stated purposes or required by statutory obligations. Afterwards the data is deleted or anonymised.
Your rights
Under the GDPR and the Spanish LOPDGDD you have the following rights:
- Access to the data we hold about you (Art. 15).
- Rectification of inaccurate data (Art. 16).
- Erasure (the "right to be forgotten", Art. 17).
- Restriction of processing (Art. 18).
- Data portability (Art. 20).
- Objection to processing (Art. 21).
- Withdrawal of any consent given, with effect for the future (Art. 7 (3)).
An informal email to info@thereseblau.com is enough to exercise your rights.
Right to lodge a complaint
You may at any time lodge a complaint with a supervisory authority, in particular the Spanish data-protection authority Agencia Española de Protección de Datos (AEPD) as lead supervisory authority, or your local German state data-protection authority.
Changes to this notice
We adapt this privacy notice when our processing or the legal situation changes. The version published on this page is the one in force.