This is a courtesy translation. The binding version is the Spanish text, which prevails in the event of any discrepancy.
1. Data controller
Owner: Antonio Cebreiro Bernárdez (ACBSEC)
Tax ID (NIF): 35589647E
Address: Lugar O Covelo 14, 36892 Ponteareas (Pontevedra), Spain
Contact email: [email protected]
Website: https://acbsec.com
2. What data I process and for what purpose
I process the data you voluntarily provide when you get in touch with me, the data of clients, suppliers and contact persons when there is an engagement and, in addition, the technical data your visit necessarily generates so that the site works and stays protected. I do not use that data to compile usage statistics or measure downloads, clicks, browsing paths or interactions with the tools. Under no circumstances do I build profiles or make automated decisions about you.
| Processing | Data | Purpose |
|---|---|---|
| Contact form | Name, email, message content and, if you provide it, company | Reply to your enquiry and, if you ask me for a proposal, prepare it |
| Email communication | The data you include in your email | Reply to you and maintain the commercial or professional relationship |
| Template requests | Requested resource and language, request date, your commercial contact choice and, only if you authorise contact, your email | Handle the request and, only if you authorise it, contact you by email about my services (details) |
| Clients, suppliers and contact persons | Identification, contact and job data; tax and bank details needed to invoice, collect or pay | Prepare proposals, perform and manage the engagement, invoice, collect payment and follow up commercially (details) |
| Website security and delivery | IP address, browser and device, page requested and referring page, date and time, request outcome and technical connection signals | Deliver the website, protect it against attacks and abuse, including temporarily blocking IP addresses that behave abusively, and keep it available |
How the forms work
The contact and template request forms use two separate Cloudflare services:
- Turnstile checks that the form is not being sent by an automated program. It loads with the form on the home page, or when you open or use another form, and analyses technical signals from your browser and connection. It does not read what you type in the fields: it generates a verification code that the form sends together with your data.
- A Worker, a small program I run on Cloudflare Workers, receives the encrypted form data, checks the verification code with Cloudflare together with your IP address and, if the request is legitimate, sends the message to my Proton Mail mailbox through its authenticated submission service (SMTP), over an encrypted connection. It does not store the content in a database or write it to its technical logs, which only record request data such as the path, time, outcome and connection data.
Required fields: in the contact form, name, email and message are required; company is optional. Without them the form is not sent and I cannot reply; if you prefer, you can email me at [email protected]. In template requests, the commercial contact box is optional and the email is only required if you tick it, because I cannot contact you without it.
Resource requests and optional commercial contact
There are two downloadable resources: the AI policy template and the guide “AI in recruitment and selection”, produced together with Usoarit. Both work the same way. The controller for these requests is solely Antonio Cebreiro Bernárdez (ACBSEC). Usoarit co-authored the guide's content but does not receive the request data and will not contact you about it.
In the “AI in recruitment and selection” guide the form also collects your company name and your answer to a question about whether you are evaluating an AI tool for recruitment. Both fields are optional, travel in the same notification and are not used for profiling.
You do not need to provide your email to download either resource. When you request it, the Worker receives the requested resource and language and your commercial contact choice, and sends me a notification with the request date. The file downloads directly in your browser; I do not send it by email.
If you tick the commercial contact box, you authorise Antonio Cebreiro Bernárdez (ACBSEC) to contact you by email about AI governance and cybersecurity services. In that case the email is required and I process it based on that consent (GDPR Article 6(1)(a)), which is optional, withdrawable and does not condition the download. If you do not tick the box, the form does not send your email even if you typed it.
Turnstile checks the request and the Worker processes it as explained in the previous section. The Worker sends a notification to my Proton Mail mailbox containing the request, your choice, your email if you authorised contact, the server timestamp and the version and wording of the information displayed. The download becomes available after Proton Mail accepts the notification; whether you save or use the document is not measured. The Worker does not create a requester database.
Retention periods, including for evidence of consent, are set out in section 3. Withdraw consent and exercise your rights by emailing [email protected]; commercial communications will include that option.
Form information versions: ai-policy-2026-09-21-v3 (AI policy template) and ia-seleccion-2026-09-24-v1 (AI in recruitment guide).
SPF, DKIM and DMARC tool
The email security tool runs in your browser. To diagnose a domain it has to read its public DNS, and to do so your browser asks Cloudflare’s DNS over HTTPS resolver (1.1.1.1, at cloudflare-dns.com) directly. Those requests do not go through my servers and only contain the names being looked up, such as _dmarc.yourdomain.com or selector1._domainkey.yourdomain.com. As with any connection, Cloudflare also receives your IP address and technical data about your browser.
Cloudflare provides that public resolver under its own 1.1.1.1 resolver privacy policy, not as my processor. In it, Cloudflare commits not to sell or share that data, not to use it for advertising and to delete the query logs within 25 hours, and it has that commitment audited externally. Its network is global, so a query may be served outside the EEA.
Two further actions only happen if you ask for them with their button:
- BIMI logo preview: your browser downloads the image from the address published by the domain being analysed, without saying which page requested it. The server hosting it receives your IP address, as with any image.
- Names of the IPs in a DMARC report: the report’s IP addresses are sent to the same Cloudflare resolver as reverse (PTR) lookups.
The headers you paste and the DMARC reports you open are processed only on your device and are not sent to my server or to third parties. The tool uses no cookies and does not store what you analyse. If you open or share a link that carries the domain in the address (?d=), that address reaches my server like any other requested page and stays in its technical logs for the period set out in section 3.
Clients, suppliers and contact persons
If you or your organisation engage my services or provide services to me, I process your identification and contact data, and that of the people involved in the engagement (signatories and points of contact), to prepare proposals, perform and manage the engagement, invoice, collect and pay. The legal basis depends on whether you contract in your own name or act on behalf of an organisation; the table in section 3 distinguishes them.
Source of the data: if you do not provide it yourself, your organisation provides it when requesting the proposal, signing the contract or appointing you as a point of contact. In that case it is limited to identification data, professional contact data and your position or role.
Invoicing and CRM: I handle invoicing and my relationship with clients and suppliers (CRM) in Holded, a cloud platform from Holded Technologies, S.L. (Spain). It holds the invoices issued and received, with the tax and bank details needed to invoice, collect and pay, and the identification and contact data of clients, suppliers and their contact persons. I do not keep in it people who merely enquire or ask me for a proposal. Holded processes that data on my behalf, as a processor (section 5).
Recipients: it may be disclosed to the Spanish Tax Agency and other public authorities where required by law, to banks to manage collections and payments and, where applicable, to courts and tribunals.
Data I access during the engagement: where, in order to provide the service, I access personal data for which your organisation is the controller (for example, user accounts, logs or emails during an audit), I act as a processor. That data is governed by the data processing agreement signed with your organisation under art. 28 GDPR, not by this policy. Rights over that data are exercised with your organisation.
3. Legal basis and retention periods
Each purpose relies on a single legal basis. When the stated period ends, I erase the data or, if I must keep it because of possible liabilities, I block it as explained in section 4.
| Purpose | Legal basis | Retention |
|---|---|---|
| Reply to general enquiries, through the form or by email | Your consent, given when you send me the enquiry after receiving this information (art. 6.1.a GDPR). You can withdraw it at any time. | As long as needed to deal with it. If it does not lead to a professional relationship, a maximum of one year. |
| Prepare a proposal or quote you request in your own name | Pre-contractual steps taken at your request (art. 6.1.b GDPR). | If you do not engage me, a maximum of one year. If you do, the next row applies. |
| Perform the contract with clients and suppliers who contract in their own name, for example as self-employed professionals | Performance of the contract (art. 6.1.b GDPR). | For the duration of the contract. Afterwards, blocked for the limitation periods of claims arising from it. |
| Maintain professional contact with people acting on behalf of a client or supplier organisation, or one that requests a proposal | Legitimate interest (art. 6.1.f GDPR and art. 19 of the Spanish Data Protection Act, LOPDGDD). I only process the data needed to reach you professionally. | While the relationship with your organisation lasts and you remain its point of contact, unless you object. Afterwards, blocked for the applicable limitation periods. |
| Meet tax and accounting obligations: invoices, books and supporting documents | Legal obligation (art. 6.1.c GDPR). | The periods set by law: generally four years for tax matters (arts. 66 and 70 of the Spanish General Tax Act) and six years for commercial records (art. 30 of the Spanish Commercial Code), where applicable. |
| Send you commercial communications by email | Your separate, optional consent (art. 6.1.a GDPR and art. 21 of the Spanish Information Society Services Act, LSSI). | Until you withdraw it or one year passes without interaction; commercial use then ceases. |
| Demonstrate that I obtained your consent or that you withdrew it | Obligation to be able to demonstrate consent (art. 7.1 GDPR, in connection with art. 6.1.c). | Only the minimum evidence (date, email, version and wording displayed, choice and, where applicable, withdrawal), with restricted access, while the authorisation is used and for up to three years afterwards, the maximum limitation period for infringements (art. 72 LOPDGDD and art. 45 LSSI). |
| Deliver the website and protect it against attacks and abuse | Legitimate interest in network and information security (art. 6.1.f GDPR and Recital 49). | Web server logs: up to 15 days, as they are rotated daily and 14 copies are kept. IP address blocks: between one hour and one day, and they may be extended if the behaviour is repeated. Worker logs: up to 7 days, according to the Cloudflare Workers Logs documentation. |
Data that Cloudflare processes as a controller to improve Turnstile is outside my control and follows its own retention periods (section 5).
4. Use, retention, blocking and erasure
- Ordinary use: I process the data for the relevant purpose while its legal basis applies and the period stated in the table lasts.
- Retention required by law: where a law requires me to keep data, as in tax and accounting matters, I keep only what is necessary and only to comply with it.
- Blocking: where data should be erased or rectified but may still be needed to establish possible liabilities, I block it in accordance with art. 32 LOPDGDD. I identify and set it aside to prevent its processing, including viewing it, and only make it available to judges and courts, the Public Prosecutor or the competent public authorities, in particular data protection authorities, for the limitation period of those liabilities.
- Destruction: once that period ends, I delete the data permanently.
Enquiries, requests and engagement records are kept in my Proton Mail mailbox and in Proton Drive; invoices and the data of clients and suppliers, in Holded. I do not use an automatic deletion system: I review and apply these periods manually. After deletion, Proton keeps encrypted backups for up to 30 days, under its Mail and Drive privacy policies, and Holded may keep recoverable or backup copies for a limited time, under its service terms. When the service with Holded ends, it may keep the data for up to 18 months from cancellation, under its data processing agreement.
5. Who I share your data with
I do not sell or transfer your data to third parties for commercial purposes. I only disclose it to the Spanish Tax Agency and other public authorities where required by law, to banks to manage collections and payments and, where applicable, to courts and tribunals.
In addition, these providers process data on my behalf, as processors (art. 28 GDPR), to provide their services to me:
- Web hosting: OVH SAS (France), which hosts the website server and its technical logs.
- Web delivery, form processing and abuse protection: Cloudflare, Inc. (United States). All acbsec.com traffic passes through its network. Cloudflare distributes content, filters malicious traffic, applies temporary IP address blocks, runs the Worker that receives and processes the forms and provides the Turnstile service.
- Email, files and video calls: Proton AG (Switzerland), through Proton Mail, which receives the validated message from the Worker and stores it in my mailbox, Proton Drive, where I keep engagement records, and Proton Meet, which I use for video meetings.
- Invoicing and CRM: Holded Technologies, S.L. (Spain), through the Holded platform, which holds the invoices and the data of my clients and suppliers.
Each provider has a data processing agreement governing its service. Those of Cloudflare, Proton and OVHcloud are public; Proton's forms part of its terms and refers to the list of sub-processors published in its privacy policy. Holded's forms part of its terms and conditions, its customers consult it on the platform itself and it refers to a public list of sub-processors in the Trust Centre of Visma, the group Holded belongs to.
Cloudflare Turnstile: two different roles
According to its Turnstile privacy notice, Cloudflare processes technical signals such as your IP address, the TLS fingerprint of the connection, the browser user agent, the sitekey and the page origin. It does so in two roles:
- As a processor, on my behalf: it uses those signals to distinguish people from automated programs and protect this website. The legal basis is my legitimate interest in website security (art. 6.1.f GDPR). Rights over this processing are exercised with me at [email protected].
- As a controller, on its own behalf: it uses the same signals to improve Turnstile's bot detection, based on its own legitimate interest. I do not decide on that processing. To exercise your rights or raise questions, you can contact its Data Protection Officer at [email protected].
Turnstile does not receive the content of the form fields. That content is received and processed by the Worker, which Cloudflare runs as a processor on my behalf.
International transfers
- OVH: the server hosting the website is located in the European Union. OVHcloud's data processing agreement governs any involvement of its affiliates or sub-processors located outside the European Economic Area (EEA).
- Cloudflare: its network is global. Each request is normally served from a data centre close to the visitor, but Cloudflare does not guarantee that processing stays within the EEA, so transfers may occur, in particular to the United States. Cloudflare, Inc. appears on the list of participating organisations in the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision, and its data processing agreement provides for the standard contractual clauses for transfers that framework does not cover.
- Proton: Proton AG is established in Switzerland, a country covered by a European Commission adequacy decision (Decision 2000/518/EC), confirmed in its January 2024 review. According to its privacy policies, Proton stores Mail and Drive data on servers located exclusively in Switzerland, Germany or Norway. Proton Meet encrypts meeting audio, video and chat end to end, and its servers only forward that encrypted data; Proton states that these servers form a network spread across data centres in several countries, so the connection data of a video call may be processed outside the EEA. For transfers to countries without an adequacy decision, its data processing agreement provides for standard contractual clauses.
- Holded: Holded Technologies, S.L. is established in Spain. Its public Trust Centre states that hosting is in the EU and EEA, with Google Cloud (Belgium), MongoDB and Amazon Web Services. For transfers outside the EEA, its data processing agreement requires compliance with Chapter V of the GDPR and provides for the European Commission's standard contractual clauses for those made by its sub-processors.
You can review these safeguards through the links above or ask me for a copy at [email protected]. Processing that Cloudflare carries out as a controller to improve Turnstile, including any transfers, is governed by its own privacy policy. I do not carry out any other international transfers.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time and free of charge, as well as withdraw the consent given without this affecting the lawfulness of prior processing. Where processing is based on my legitimate interest, you may object on grounds relating to your particular situation.
To do so, write to me at [email protected] stating the right you wish to exercise. I will respond within a maximum of one month. For the processing Cloudflare carries out as a controller through Turnstile, contact [email protected].
If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
7. Information security
As a cybersecurity professional, I apply technical and organisational measures appropriate to the risk in order to protect your data against unauthorised access, loss or alteration, in accordance with art. 32 GDPR.
8. Minors
The services on this website are aimed exclusively at professionals and companies. I do not knowingly collect data from children under 14.
9. Changes to this policy
I may update this policy to adapt it to legislative changes or to changes in the services provided. The version in force will always be the one published on this page, with its update date.