Privacy Policy

Privacy Policy

This privacy policy explains how Sebastian Iskra, trading under the business name Revenue Marketing IO („we“, „us“" or "„our“) collects, uses and protects personal data when you use our website (revenuemarketing.io) when you visit or otherwise interact with us. We are committed to protecting your personal data and comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) (GDPR) and Spanish Organic Law 3/2018 of December 5 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

1. Responsible party and contact details

The entity responsible for processing your personal data is:

If you have any questions about this privacy policy or wish to exercise your data protection rights, you can contact us via the email address above. (Our company is currently neither legally required nor has appointed a data protection officer.)

2. Applicable Law and Principles

Our data protection practices are designed to comply with the GDPR and the LOPDGDD. We process personal data lawfully, fairly, and transparently, solely for specified and legitimate purposes. We collect and use only data that is adequate, relevant, and limited to what is necessary for the respective processing purposes.Data minimizationWe take appropriate measures to ensure that personal data is accurate and up-to-date, and do not retain it longer than necessary (Memory limitFurthermore, we implement appropriate security measures to protect personal data (Integrity and confidentiality).

3. How we collect and use personal data

We may collect personal data from you in various ways, including when you visit our website, contact us, or use our services. Below, we explain which categories of data we collect, for what purposes we use them, and on what legal basis this is done.

3.1 Visiting our website (usage data and cookies)

Data collected: When you visit our website, certain technical information and usage data are automatically collected by our web server and via cookies or similar tracking technologies. This may include your IP address, browser type and version, device identifiers, operating system, referring website, pages visited, date and time of access, and other usage actions. Additionally, we may collect cookie identifiers and analytics data if you have consented to non-essential cookies (see section 4 on cookies and analytics).

Purpose: We use this information to load and display the website correctly, to ensure the website's security and performance, and to understand how visitors use our website so that we can improve content, user experience, and our services. We use analytics data (e.g., from Google Analytics) to create aggregated statistics on website usage and the effectiveness of our marketing, but never to identify you individually without your consent.

Legal basis: The processing of basic usage data and necessary cookies is based on our legitimate interest (Article 6 paragraph 1 letter f GDPR) in a secure, functional website and its improvement. We have weighed this interest against your rights and consider this processing to be non-intrusive, as it is limited to technical data. For analytics or preference cookies, we rely on your consent (Article 6 paragraph 1 letter a GDPR), which is obtained via our cookie consent banner. You have the right to accept or reject such cookies (see section 4).

3.2 Contacting us (contact forms, emails, scheduling appointments)

Data collected: When you contact us by email or via a contact form on our website (for example, to request information or ask a question) or arrange an appointment with us via our online appointment scheduling tool, you provide personal data such as name, email address, telephone number (optional), company name and any other information you provide in your message or appointment request.

Purpose: We use this data solely to respond to your inquiry, provide the requested information or support, and communicate with you about scheduling and appointment details. If you use our appointment booking function, the data will be used to arrange and confirm the appointment. We may also store correspondence for internal administrative purposes and to improve our customer service (for example, to be able to refer back to previous communication if you contact us again).

Legal basis: The processing of your contact details in this context is necessary to take action at your request prior to entering into a contract, or to answer your inquiries; this is considered legitimate interest on our part or as pre-contractual processing (Article 6 paragraph 1 letter b GDPR or Article 6 paragraph 1 letter f GDPR). If your inquiry could lead to a contract or business relationship, Article 6 paragraph 1 letter b GDPR applies. In other cases, we rely on our legitimate interest in responding to inquiries addressed to us. In any case, we only use the data that you provide to us for processing your inquiry.

3.3 Newsletters and Marketing Communications

Data collected: When you subscribe to our newsletter or consent to receive marketing communications from us (for example, by providing your email address to download a resource or request updates), we collect your name, email address, and, if applicable, your company and preferences. We may also record your consent to the subscription and, where applicable, the date and time of consent (as part of our documentation obligations). Additionally, our email marketing system may track interactions with our emails, such as opens and link clicks, for statistical purposes.

Purpose: We use this information to regularly send you newsletters, industry insights, updates on our services, invitations to events, or other marketing communications that you have requested or consented to. Our goal is to keep you informed about topics relevant to you and our offers. We use interaction data (opens/clicks) to measure engagement and improve our email content, not to profile you beyond your email preferences.

Legal basis: The sending of newsletters or marketing emails is based on your explicit consent. consent (Article 6 paragraph 1 letter a GDPR). You will only receive such communications if you have actively registered or consented (for example, by ticking a box or confirming via double opt-in email, where applicable). You can withdraw your consent at any time (see section 9 regarding your rights) by using the "unsubscribe" link included in every marketing email or by contacting us via our email address. Withdrawing your consent does not affect the lawfulness of emails sent before the withdrawal.

Special case: Download and tool requests: When you request a download (e.g., a reference or white paper) or access to an interactive tool via a form on our website, we process your information (name, business email address, company name if applicable, and LinkedIn profile) primarily to provide this download or tool and to potentially contact you. The legal basis for this is Article 6(1)(b) GDPR (fulfilling your request) or Article 6(1)(f) GDPR (our legitimate interest in contacting you for a potential exchange). This processing is independent of any separate consent to receive our newsletter as described in section 3.3 above.

3.4 Business relationships and services

Data collected: When you use our services as a customer or business partner, we collect the personal data necessary to maintain our business relationship. This may include contact details of contact persons (name, business email address, telephone number), billing information, contract details, and other personal data provided in the course of providing our services (e.g., project-related communication).

Purpose: We use this data to execute and manage the contractual relationship, including providing marketing consulting services, account management, payment processing, and communication regarding the project or contract. We also maintain records required for legal and accounting purposes.

Legal basis: For customers and business partners, the processing for Contract fulfillment (Art. 6 para. 1 lit. b GDPR) or necessary for compliance with legal obligations (Art. 6 para. 1 lit. c GDPR), for example in the context of accounting. Additionally, certain communication with business contacts on our legitimate interest The legal basis for processing (Art. 6 para. 1 lit. f GDPR) is the maintenance of the business relationship. In Spain, business contact details used for professional communication may be processed on the basis of legitimate interest in accordance with Article 19 of the LOPDGDD, ensuring that only relevant business data is used.

4. Cookies and Analytics

Our website uses cookies and similar technologies to improve the user experience and analyze website performance. On your first visit to our website, you will see a cookie consent banner where you can accept or decline non-essential cookies. You can manage your preferences at any time via this banner or through your browser settings.

4.1 What are cookies?

Cookies are small text files that websites you visit store on your device (computer, smartphone, etc.). They contain information that is transferred to your device's hard drive. Cookies can be "first-party" (set by us) or "third-party" (set by external providers) and can be either session cookies (deleted when you close your browser) or persistent cookies (valid for a specified period or until deleted).

4.2 Types of cookies we use

  • Strictly necessary cookies: These cookies are essential for the operation of our website and enable core functions (such as security, network management, and accessibility). Without these cookies, the website may not function properly. They do not require user consent under applicable law.
  • Preference/Functional Cookies: If used, these cookies allow our website to save your choices (e.g., language settings) and offer enhanced, more personalized features. They can be set by us or by third-party services that we have integrated into our pages. We only use such cookies if you have given your consent, and where required.
  • Analytics cookies: These cookies (e.g., from Google Analytics) collect information about how visitors use our website, such as which pages are visited most frequently, how users navigate the site, and whether error messages occur. This information is collected in aggregated and anonymous form (we do not use it to identify you). Analytics cookies help us improve the functionality of our website. We only place analytics cookies on your device if you have consented via the cookie banner.
  • Marketing/tracking cookies: These cookies, if present, are used to track visitors across websites in order to display more relevant advertising or marketing messages. We currently do not use any advertising cookies or pixels for third-party marketing on our website. Should this change, we will explicitly obtain your consent before activating them.

4.3 Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC (for the EU: Google Ireland Limited), to understand how visitors interact with our website. Google Analytics uses cookies and similar technologies to collect data on website usage (see "Analytics Cookies" above). The information generated by these cookies (which may include your IP address and usage data) is generally transmitted to Google servers. We have configured Google Analytics to protect your privacy as follows:

  • We use Google Analytics 4 (GA4), which by design does not store individual IP addresses and employs anonymization measures. In earlier versions, or where applicable, we have activated IP anonymization, so that Google shortens/anonymizes the last octet of the IP address within the EU/EEA before storing it.
  • Google Analytics data is processed in aggregated form. We do not use it to identify individual users and do not combine it with other data to create user profiles.
  • We have set appropriate retention periods in Google Analytics (e.g., the retention of user and event data is limited, usually to 14 months, and resets with new activity, according to Google's options) to ensure that personal data is not retained longer than necessary.

Data transmission and security measures: Google LLC is based in the United States, so analytics data may be transferred to and processed on servers in the US. We have entered into the European Commission's Standard Contractual Clauses (SCCs) with Google as part of our data processing agreement to provide appropriate safeguards for this international transfer. Google also states that it complies with the EU-US Data Privacy Framework for permissible data transfers. Despite these measures, US intelligence agencies could, in rare cases, access data for legitimate purposes, and such transfers pose a potential risk to data privacy. By consenting to analytics cookies, you acknowledge and accept that your data may be processed in the US under these conditions.

Legal basis: We only use Google Analytics with your consent (Art. 6 para. 1 lit. a GDPR). If you do not consent or withdraw your consent, no analytics cookies will be set and no data will be collected via Google Analytics. This does not affect your ability to use our website. You can also find out more about this in the privacy policy. Google Analytics Opt-out Browser Add-on Opt out of Google Analytics.

For more information about Google Analytics' data practices, please see Google's Privacy Policy and Google Analytics Terms of Service on Google's website.

4.4 Cookie consent mechanism

In accordance with Spanish law (Law 34/2002 on Information Society Services, "LSSI") and the requirements of the GDPR, we use a cookie consent mechanism. On your first visit and at regular intervals thereafter, a banner will appear requesting your consent for non-essential cookies (analytics and other). You can choose to "Accept all," "Reject all" (referring to non-essential cookies), or customize your preferences. Strictly necessary cookies (essential for the website to function) are always active and do not store any personal data beyond what is necessary for their purpose.

You can change or withdraw your cookie consent at any time. If you wish to adjust your preferences later, you can do so via the "Cookie Settings" link (if available on our website) or by deleting cookies in your browser, which will cause the consent banner to reappear on your next visit. Additionally, most web browsers allow you to manage or block cookies through their settings.

4.5 Web analytics with Matomo (without cookies)

We use Matomo, an open-source web analytics software, to understand how our website is used, for example, which pages are visited and which sources bring visitors from. Matomo runs on our own server within our WordPress installation. The data is not transmitted to the provider of Matomo or to any other third parties.

We have configured Matomo so that no cookies are set and your IP address is shortened before being stored. This prevents us from linking the data to you personally. The following data is processed: shortened IP address, pages visited, date and time of access, referrer URL, browser, operating system, device type, and screen resolution.

Legal basis: Article 6 paragraph 1 letter f GDPR. Our legitimate interest lies in the statistical analysis and improvement of our website.

Storage duration: We delete the raw data after a maximum of 14 months.

Contradiction: You can opt out of the analysis at any time. You'll find the button to do so at the bottom of this page.

4.6 Protection against spam (Google reCAPTCHA)

To protect our forms from spam and automated requests, we use Google reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). reCAPTCHA verifies whether an entry is made by a human or an automated program. To do this, reCAPTCHA analyzes, among other things, your IP address, browser and device information, the time spent on the page, and mouse movements, and may set cookies. This data is transmitted to Google and may also be processed on servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: Article 6 paragraph 1 letter f GDPR. Our legitimate interest lies in protecting our website and our forms from misuse and spam.

You can find more information in Google's privacy policy (https://policies.google.com/privacy).

5. Third-party services and data processors

To operate our website and provide our services, we work with a number of trusted third-party service providers (data processors) who may process personal data on our behalf. We ensure that all data processors we use are subject to appropriate data protection obligations (through contracts or data processing agreements) and process your data only for the purposes we have specified, in accordance with this privacy policy.

Below you will find a list of the most important third-party services we use, as well as information about what they do and how they process personal data:

5.1 Web hosting and infrastructure

Our website is hosted on the servers of an external hosting company. This means that all data transmitted to our website (such as IP addresses in server log files and any data you submit via the website) is stored and processed on our hosting provider's servers. We have chosen a hosting provider that adheres to high security standards to protect the data on its servers, including firewalls, encryption, and access control.

Provider: netcup GmbH (Germany)
Location: Data centers in Germany (EU)

Relevant data & purpose: The hosting provider stores website content and data necessary for the website's operation. It automatically logs certain data (IP address, access time, pages visited, etc.) in server log files for security, troubleshooting, and traffic analysis purposes. This is necessary to provide you with the website (as part of our service to you as a user) and to protect ourselves against cyberattacks.

Legal basis: Hosting and processing by the provider are based on Article 6 paragraph 1 letter f GDPR (legitimate interest), Our legitimate interest in reliable and secure hosting of our website. Insofar as the storage and retrieval of information on your device (e.g., via cookies for load balancing or security) is necessary, this is exempt from the consent requirement, as it is strictly necessary.

The hosting provider acts on our instructions and will not access or use your data except to the extent necessary to fulfill its hosting obligations. If our hosting provider is located outside the European Economic Area (EEA) or uses servers outside the EEA, we ensure that appropriate safeguards (such as standard contractual clauses) are in place to lawfully conduct any necessary international transfer of personal data.

5.2 Customer Relationship Management (CRM) and Forms (HubSpot)

We use HubSpot, an integrated CRM and marketing platform, to manage our contact forms, appointment scheduler, and customer relationships. HubSpot is provided by HubSpot, Inc. (25 First Street, Cambridge, MA 02141, USA) and its European subsidiary, HubSpot Ireland Limited.

Data and purpose: When you fill out a form on our website (such as a contact form, a newsletter signup form, or when you schedule an appointment), the information you provide is transmitted to HubSpot's servers. HubSpot helps us organize and store contact information (such as name, email, phone number, company, etc.), track communication, and respond to you. The appointment scheduling tool on our website is also powered by HubSpot's appointment feature, which collects your details to book an appointment in our calendar and sends you confirmation/reminder emails. HubSpot may set functional cookies to ensure form submissions and, where applicable, content logins function correctly, and may use analytics data to provide us with insights into form usage (we have configured HubSpot to respect cookie consent preferences for tracking).

Legal basis: We process data via HubSpot on the same legal bases explained in Section 3 for the respective context (your consent for marketing/newsletter sign-ups or legitimate interest/pre-contractual necessity for contact requests and appointment scheduling). HubSpot acts as a data processor on our instructions.

Data location and transmission: Depending on our account settings, HubSpot may store data on servers in the United States or the European Union. We have a data processing agreement with HubSpot, including the EU Standard Contractual Clauses, which covers any transfer of personal data to the US or other countries without an adequacy decision. As of the last update, HubSpot is also certified under the EU-US Data Privacy Framework, demonstrating compliance with EU data protection principles for transferred data. We have enabled privacy features in HubSpot that support GDPR compliance (such as disabling cookie tracking for non-consenting users and respecting opt-out preferences).

You can find more information about HubSpot's privacy practices in the HubSpot Privacy Policy. All data you submit via our forms will be used exclusively for the purposes stated at the time of collection and securely managed via HubSpot.

5.3 Email marketing (Mailchimp)

Our newsletter and marketing emails are delivered via the service Mailchimp Managed and operated by The Rocket Science Group LLC, based in Atlanta, GA, USA (now an Intuit company), Mailchimp is a widely used email marketing platform.

Data and purpose: When you subscribe to our newsletter or other marketing communications, the information you provide (such as your email address, name, and other details) will be transferred to and stored on Mailchimp's servers. We use Mailchimp to create, send, and track our email campaigns. Mailchimp helps us manage our subscriber list and provides insights into email delivery and interaction (for example, whether you opened an email or clicked a link). We use this information to improve our content and ensure we send relevant information to our subscribers. Mailchimp also ensures we properly manage subscriptions (e.g., unsubscribes and proof of consent and signup date for compliance purposes).

Legal basis: The processing of your data for email marketing via Mailchimp is based on your consent (Art. 6 para. 1 lit. a GDPR), as explained in section 3.3. We will only add you to our mailing list if you have given your consent, usually via a registration form and, where applicable, an email confirmation (double opt-in). You can unsubscribe at any time, after which Mailchimp will automatically ensure that your address is excluded from future mailings.

Data transmission and security measures: Mailchimp's servers are primarily located in the United States. Therefore, your personal data (email address, name, and all email interaction data) will be transferred to the USA for processing. We have entered into standard contractual clauses with Mailchimp through their data processing agreement to protect your data during this transfer. Additionally, as of the latest available information, Mailchimp has committed to the principles of the EU-US Data Privacy Framework, which provides an extra level of security for transatlantic data transfers. You can find more information about Mailchimp's protection of personal data in their [link to privacy policy/data protection statement]. Mailchimp Privacy Policy.

Mailchimp will not use your email address to contact you directly or share it with third parties, except as permitted by Mailchimp's Terms of Service (for example, to improve its own service or due to legal obligations). Our mailing list is used solely for our communication purposes and will not be sold or shared externally.

5.4 Other service providers

In addition to the above, we may use other third-party services to operate our business and website if necessary, for example:

  • IT and security services: We may use cloud storage or backup services, IT support, or security monitoring services that may process stored data as a side effect. All these providers are contractually obligated to confidentiality and data protection.
  • Analysis and tag management: In addition to Google Analytics (see section 4.3), we use Google Tag Manager to manage various scripts on our website. Google Tag Manager is a tool that delivers other scripts and tags and does not itself collect any personal data. However, it may transmit your IP address to retrieve scripts from Google's servers. This usage is based on our legitimate interest in efficiently managing the technical aspects of our website.
  • Social media and plug-ins: We maintain a presence on platforms like LinkedIn. Our website may contain links to our social media profiles or share buttons. We do not integrate any social media plugins that automatically transmit your data to these platforms without your interaction. If you follow a link to LinkedIn or another external website, please note that these websites have their own privacy policies and we have no control over their data processing practices.

We will update this privacy policy to reflect any significant changes in our use of data processors. All our providers are selected based on their commitment to data security and privacy.

5.5 Google Drive (storage of downloaded files)

Documents that you request via a download or form on our website (e.g., references, white papers, or similar resources) are hosted on Google Drive, a cloud storage service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The download link leads directly to the respective file on Google Drive. Google's privacy policy also applies in this respect (see also section 4.3 on Google Analytics for further information on Google's data processing and the relevant transfer mechanisms to third countries).

5.6 Processing of form data (WordPress/Elementor)

Forms on our website (for example, contact, download, or tool access forms) are processed technically via our own WordPress installation using the Elementor Forms plugin. Your information is stored directly on our own server and is not transferred to an external form service provider. Additionally, your information may be forwarded to us via email to process your request (see section 5.1 regarding our email/hosting provider).

6. Data Sharing and Disclosure

We treat your personal data carefully and confidentially. We do not sell or rent your personal data to third parties. We only share your data in the following cases:

  • To service providers (data processors): As described above in section 5, we share data with third-party service providers who perform functions on our behalf (such as hosting, email delivery, data analysis, etc.). These providers are contractually obligated to process data only according to our instructions and to implement appropriate security measures.
  • Within our organization: Personal data may be accessed by individuals at Sebastian Iskra (Revenue Marketing IO) who need to process it to fulfill the purposes described. This includes our small team as well as trusted contractors, all of whom are contractually bound to confidentiality and data protection.
  • To fulfill legal obligations: We may disclose personal data if required by law or in response to a lawful request from a government or law enforcement agency (for example, to comply with tax, reporting, or other legal requirements).
  • To protect rights and interests: In rare cases, we may disclose data to establish, exercise, or defend our legal rights. In the event of litigation or a legal claim, we may be required to provide relevant information to our legal counsel or a court. We may also disclose data to investigate or prevent fraud or security issues.
  • Business transfers: Should our company undergo a restructuring in the future, such as a merger, acquisition, or sale of assets, personal data may be transferred to the legal successor. In this case, we will ensure that the new owner handles the data in accordance with this privacy policy and applicable laws, and we will inform you of any changes in data processing.

Whenever we share your data, we only share the minimum amount necessary for the respective purpose and, where applicable, in pseudonymized or anonymized form.

7. International Data Transfers

As a company based in the European Union (Spain), we primarily process and store your data within the EU/EEA. However, as mentioned, some of our service providers are located in countries outside the European Economic Area (for example, the United States) or may store data there. Whenever your personal data is transferred outside the EU/EEA, we ensure that one of the following safeguards is in place:

  • Adequacy decision of the European Commission: If the data is transferred to a country for which the European Commission has determined an adequate level of data protection (an "adequacy decision"), the transfer of your data is based on this. (For example, transfers to countries such as the United Kingdom, Switzerland, or other countries deemed adequate.)
  • Standard Contractual Clauses (SCCs): We use the current Standard Contractual Clauses (legally binding contracts) approved by the European Commission with the recipient of the data, who is thereby obligated to protect your data in accordance with EU standards. All our providers based in the USA (such as Google, HubSpot, Mailchimp) are integrated via SCCs as part of their data protection add-ons.
  • Data Privacy Framework or binding internal data protection regulations: Where applicable, if a recipient in the USA is certified under the new EU-US Data Privacy Framework (as of 2023) or a company has approved Binding Corporate Rules, we may rely on these mechanisms to secure the transfer.
  • Explicit consent in certain cases: Should we, in the unlikely event, need to transfer data without the aforementioned guarantees, we would inform you and obtain your explicit consent (Art. 49 para. 1 lit. a GDPR) or rely on another permissible exception under Art. 49 GDPR (for example, if the transfer is necessary for the performance of a contract with you or for the establishment/exercise of legal claims).

We are aware of the legal situation regarding international data transfers (including in light of rulings such as Schrems II). We continuously monitor the compliance of our data processors and implement additional measures where necessary (such as encryption during transmission and at rest, minimizing the size of the transferred data, etc.). If you have any questions about the guarantees for the international transfer of your data, please contact us via our email address.

8. Storage period and deletion

We do not retain your personal data longer than necessary for the purposes for which it was processed, unless a longer retention period is required or permitted by law. When determining retention periods, we consider the type of data, the processing purpose, and any applicable legal requirements (e.g., tax or accounting regulations, applicable limitation periods).

In general, we apply the following retention guidelines:

  • Website usage data (server logs): Our web server and security logs are generally kept for a short period (usually 7 to 30 days), unless we need to retain them longer to investigate security incidents or misuse. After that, they are automatically deleted or anonymized.
  • Analysis data: As explained in section 4.3, Google Analytics data is retained according to our settings (currently 14 months by default for user-level data). Analytics reports do not contain any personally identifiable information and may be retained for longer in aggregated form for historical analysis.
  • Contact form inquiries and emails: If you contact us but do not become a customer or continue the communication, we will retain your correspondence and the personal data it contains for as long as necessary to process your request, and for a reasonable period thereafter in case of follow-up questions. We generally review contact details regularly and delete data that is no longer needed (generally within 1 to 2 years). However, our email archives can securely store communications for up to 5 years, after which we delete or anonymize them unless continued retention is required (e.g., for legal proceedings).
  • Scheduling data: If you scheduled an appointment but didn't use our services, we treat this similarly to contact requests. The appointment-related data stored in HubSpot (name, email, etc.) is retained for follow-up purposes and then routinely deleted upon request or due to inactivity.
  • Newsletter subscription data: We retain your email address and associated profile information for as long as you are subscribed to our newsletter or marketing communications. If you unsubscribe, we will immediately stop sending you emails. We may add your email address to a suppression list to respect your opt-out (so you are not accidentally added back), as required by law. Mailchimp handles this automatically by marking unsubscribed addresses, and we retain this information for our records. We regularly clean our mailing list to remove inactive or undeliverable contacts.
  • Customer and contract data: For clients with whom we have an ongoing contract or have completed a project, we retain contract-related personal data for the duration of the contract and thereafter in accordance with legal requirements. Spanish commercial and tax law may require us to retain certain documents (e.g., invoices containing personal data) for up to 5 years (or longer if specific regulations require it). Project-related communications and files may be retained for a similar period after project completion in case of follow-up questions or work. After the statutory retention periods have expired, we securely delete or anonymize clients' personal data if it is no longer needed.

When we delete personal data, we ensure that it is removed from our active systems and that backups are overwritten or also deleted where possible. In cases where immediate deletion is not possible (e.g., data in secure archives), we ensure that it is not used for any other purpose and remains securely stored until it can be deleted.

If you believe that we are storing your personal data for longer than necessary, please contact us; we will review this and, if necessary, securely delete the data.

9. Your rights as a data subject

Under the GDPR and the LOPDGDD, you have various rights regarding your personal data. We are committed to respecting your rights and enabling you to exercise them. Your most important data protection rights include:

  • Right to information: You have the right to obtain confirmation as to whether or not we process personal data about you, and if so, to request a copy of the personal data we hold about you, along with information about how we use it (as set out in this privacy policy).
  • Right to rectification: You have the right to request that we correct or update any inaccurate or incomplete personal data we hold about you. Please let us know if your details change or if you notice any inaccuracies.
  • Right to erasure („right to be forgotten“): You have the right to request the deletion of your personal data if it is no longer necessary for the purposes for which it was collected or if other conditions apply (for example, if you withdraw your consent and there is no other legal basis for processing, or if you believe the processing is unlawful). We will comply with legitimate deletion requests unless there is another legal obligation to retain the data.
  • Right to restriction of processing: You can ask us to restrict (pause) the processing of your personal data in certain situations, for example, if you dispute the accuracy of the data or have objected to the processing (until the matter is reviewed). During the restriction period, we will store your data securely and will not process it further, except as permitted by you or as required by law.
  • Right to object: You have the right to object to the processing of your personal data if we process it based on legitimate interests (Art. 6 para. 1 lit. f GDPR) or for direct marketing purposes. If you object to direct marketing, we will immediately cease processing your data for these purposes. If you object to processing based on other legitimate interests, we will re-examine our grounds and either cease processing or demonstrate compelling legitimate grounds that override your rights.
  • Right to data portability: For data you have provided to us and which we process automatically based on your consent or a contract, you have the right to request that we provide it to you in a structured, commonly used, machine-readable format or, where technically feasible, transmit it directly to another controller. This makes it easier for you to reuse your data across different services.
  • Right to withdraw consent: If we rely on your consent for processing your data (e.g., when sending newsletters or using certain cookies), you have the right to withdraw this consent at any time. Withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw your consent by contacting us, adjusting your cookie settings (in the case of cookies), or clicking "Unsubscribe" in emails.
  • Right not to be subject to an automated decision: We do not make decisions based solely on automated processing, including profiling, that have legal effects concerning you or similarly significantly affect you. Should this change, you would have the right to human intervention and the right to contest the decision.

Exercising your rights: You can exercise any of these rights by contacting us at contact@revenuemarketing.io When you contact us, please clearly state which right you wish to exercise and provide the necessary information for identity verification (we may need to request additional information or proof of identity to ensure that we do not disclose data to the wrong person). We will respond to your request as soon as possible, and in any case within one month, as required by law (this may be extended by two further months for complex requests; however, we will inform you if an extension is necessary).

Exercising your rights is free of charge. However, if requests are clearly unfounded or excessive (for example, repeated requests), the law allows us to either charge a reasonable fee for administrative costs or refuse the request. We will not refuse any request without a clear explanation.

Right to appeal: If you believe that your data protection rights have been violated or you are dissatisfied with how we have handled your personal data or a request, you have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, your place of work, or the place of the alleged infringement. As our company is based in Spain, our lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPDInformation on how to file a complaint can be found on the AEPD website: www.aepd.es. The address of the AEPD is C/ Jorge Juan, 6, 28001 Madrid, Spain. However, we would appreciate it if you would give us the opportunity to clarify your concerns before contacting the AEPD.

10. Data security measures

We take the security of your personal data seriously. We implement a range of technical and organizational security measures to protect your information from unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

  • Encryption: Our website is secured using SSL/TLS encryption (HTTPS). This means that data transmitted between your browser and our website (such as form submissions) is encrypted during transmission, preventing eavesdropping. Where applicable, we also encrypt sensitive data at rest in our databases or cloud storage.
  • Access control: Personal data is only accessible to those who need it to perform their duties. We restrict access to systems and databases to authorized personnel, who are each subject to confidentiality obligations. Administrative access to our systems is protected by strong authentication (such as strong passwords and, where possible, two-factor authentication).
  • Data minimization: We collect and store only the minimum amount of personal data necessary for the purposes described. By retaining less data, we reduce the risk associated with data breaches. We also pseudonymize or anonymize data where possible, particularly for analysis or reporting purposes.
  • Monitoring and testing: We keep our software, website platform, and plugins up to date to prevent security vulnerabilities. We use security tools and monitoring to detect and respond to suspicious activity or intrusion attempts. Regular backups are performed to ensure data integrity, and we have disaster recovery procedures in place.
  • Third-party protection: When we use data processors (as listed in Section 5), we review their security practices. Our data processing agreements require them to implement appropriate security measures. For example, our hosting provider and cloud services have certifications such as ISO 27001 or SOC 2, and providers like HubSpot, Google, and Mailchimp are known to invest heavily in security.

Despite all these precautions, no system can be 100% secure. Nevertheless, we strive to use economically reasonable means to protect your personal data. In the unlikely event of a data breach that poses a significant risk to your rights and freedoms, we will notify you and the relevant authorities (such as the AEPD) in accordance with Articles 33 and 34 of the GDPR.

We also ask you to help protect your data. Please do not send us any unnecessary sensitive information by email and ensure that all passwords or login details you use are kept confidential and secure.

11. Data protection for minors

Our services and website are not intended for individuals under the age of 16, and we do not knowingly collect personal data from children. In Spain, the law (LOPDGDD) requires parental or guardian consent for the processing of personal data of children under 14. We do not intend to collect data from minors under 14. If you are under 14, please do not provide us with any personal data. If you are between 14 and 18, you should review this statement with a parent or guardian to ensure you understand it.

Should we discover that we have inadvertently collected personal information from a child under the age of 14 without the necessary consent, we will take steps to delete this information as quickly as possible. If you believe we may have information from or about a minor, please contact us so we can investigate and take appropriate action.

12. External Links

Our website may contain links to external websites or resources that are not operated by us (for example, a link to our LinkedIn profile or references to articles). This privacy policy applies solely to our website and our own processing of personal data. If you click on an external link, you will be redirected to that third party's website. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of third-party websites or services. We recommend that you read the privacy policy of every website you visit. However, we strive to link only to reputable sources and to clearly indicate when you leave our website.

13. Changes to this Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other operational reasons. When changes are made, we will update the "last updated" date at the end of this policy. For significant changes, we may also provide more prominent notice (such as a banner on our website or an email notification, where appropriate and practicable). We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Continued use of our website or services after changes to this privacy policy will, to the extent permitted by law, be deemed as acknowledgment of the changes and your agreement to comply with the updated terms.

14. Contact information

If you have any questions, concerns or requests regarding this privacy policy or the way we process your personal data, please contact us:

  • E-mail: contact@revenuemarketing.io
  • Post: Sebastian Iskra (Revenue Marketing IO), Carrer dels Angels 8, 2° 2a, 08001 Barcelona, Spain

We are happy to help you and will do our best to address all your concerns.

Last updated: July 28, 2026