Privacy policy

The controller of the data collected through this website is Carlos Cabezón Estévanez, tax ID 30632692G, with address at Calle Floridablanca 19B, 2ºB, 28200 San Lorenzo de El Escorial (Madrid, Spain).

For any question about this policy or about exercising your rights, you can write to carlos@carloscabezon.com.

Through the Organisational Maturity Diagnostic we collect the following data, which you provide voluntarily: name, email address, company, role, sector of activity and employee headcount range.

We also collect the answers you give to the ten questions of the diagnostic. These answers refer to the organisation, not to specific individuals, and we never ask you for data about third parties.

If you accept analytics in the cookie notice, we also store with the diagnostic how you reached the site: the campaign or referring website, if any, and the first page you opened.

We do not collect special categories of data and we do not use advertising cookies. To know how many visits the site receives we use Vercel Analytics, a measurement tool that sets no cookies and does not identify individuals. In addition, if you accept analytics in the cookie notice, we use Google Analytics to see how people browse the site: pages visited and interactions, where the visit came from, device type and approximate location. You can read the detail in the cookie policy.

We process your data for four purposes:

• To calculate the result of your diagnostic and display it on screen.
• To prepare and send you the diagnostic report and, where appropriate, to propose a working session.
• To stay in contact with you regarding the advisory services related to the diagnostic you requested.
• If you accept analytics, to measure how the site is used and to know which channels and campaigns bring visits and diagnostics.

We do not share your data with third parties for commercial purposes, we do not sell it, and we do not use it to make automated decisions producing legal effects concerning you.

The legal basis for processing the diagnostic data is your consent, given expressly by ticking the corresponding box before submitting the diagnostic, under article 6.1.a of the General Data Protection Regulation.

You may withdraw that consent at any time by writing to the address given in section 1. Withdrawal does not affect the lawfulness of processing carried out before it.

For analytics (Google Analytics and the record of how you reached the site), the legal basis is the consent you give in the cookie notice. You can withdraw it at any time from the “Cookie settings” link at the foot of the site's pages. Withdrawal does not affect the lawfulness of processing carried out before it either.

We keep your data for 24 months from the moment you complete the diagnostic. If a professional relationship begins within that period, we keep it for the duration of that relationship and, afterwards, for the statutory limitation periods applicable under tax and commercial law.

Once those periods have elapsed, the data is deleted. If you withdraw your consent before then, we delete it at that point.

To deliver the service we work with technology providers acting as data processors, who access your data solely in order to provide their service to us:

Except for Google Ireland Limited, which is in Ireland, these providers are located outside the European Economic Area, and Google may process analytics data in the United States. International data transfers are covered by the EU-US Data Privacy Framework or, failing that, by the Standard Contractual Clauses approved by the European Commission.

You may exercise the following rights at any time:

• Access the data we hold about you.
• Rectify it if it is inaccurate.
• Request its erasure.
• Request restriction of its processing.
• Object to the processing.
• Request the portability of your data.
• Withdraw the consent you gave.

To exercise them, write to carlos@carloscabezon.com stating which right you wish to exercise. We will respond within a maximum of one month.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency, at calle Jorge Juan 6, 28001 Madrid, Spain, website www.aepd.es.

We apply technical and organisational measures to protect your data against unauthorised access, loss and alteration. Access to the information collected is restricted and protected by credentials.

We may update this policy to reflect regulatory changes or changes to the service. The date of the last update appears at the top of this page.

This is a courtesy translation. In the event of any discrepancy, the Spanish version of this policy prevails. You can read it at carloscabezon.com/privacidad.