Last updated: 18 October 2026
For privacy enquiries or to exercise your rights, write to agustin@agustinbosio.com.
1. Data controller
The controller is Agustín Bosio, an independent professional established in Spain and the owner of agustinbosio.com. You can contact agustin@agustinbosio.com about your personal data.
2. Information collected
The form requests your name, email address, company, business type and message. These fields are required to submit an enquiry. Please avoid passwords, health data or other sensitive or confidential information that is unnecessary to explain your request.
The email also includes the form language, submission date and time, and your marketing choice. If you opt in, the text and version of your consent are recorded. A hidden field helps detect spam: submissions that fill it are discarded without sending an email. The form does not accept attachments.
Servers handling the connection may process technical information, such as IP addresses, headers and incident logs, to provide and protect the service. The application does not add your IP address to the email body or use this information for marketing profiles.
3. Purposes and legal bases
Service enquiries: to review your request, reply and, where appropriate, prepare a proposal. The legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)). For other professional enquiries, the basis is the legitimate interest in maintaining and responding to that communication (Article 6(1)(f)), considering your rights and reasonable expectations.
Marketing emails: only if you voluntarily tick the relevant box. Your name and email address will be used to send content and offers from Agustín Bosio about supply chain and operations consulting. The basis is your consent (Article 6(1)(a)). The box is unticked by default and consent is not required to submit an enquiry.
Security and troubleshooting: the legitimate interest in protecting the website, preventing abuse and resolving errors. Information is limited to what is necessary for these purposes. The form does not make automated decisions with legal effects or carry out profiling.
4. Gmail delivery and the Google connection
Visitors do not sign in with Google or grant access to their own accounts. The OAuth connection belongs to the account authorised by the site owner to send contact form messages.
The requested permissions are gmail.send, to send email, and openid and email, to identify the authorised account and its email address. The application does not request permission to read inbox messages, contacts or Google Drive files.
The server sends your enquiry through the Gmail API to the address configured by the owner. Your email address is used as Reply-To to allow a direct response. The form code does not store enquiries in a website database; messages are retained in email.
Google account information and tokens obtained through the connection are used exclusively to identify that account and enable sending. They are not used for marketing, advertising or AI model training. The use of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.
Credentials remain in server configuration and are not delivered to visitors’ browsers. The owner can revoke the connection through their Google account. Revocation prevents future sends but does not delete messages already sent or received.
5. Providers and international transfers
Render hosts the website and processes requests; Google/Gmail processes and stores the emails needed to handle enquiries. Their access is limited to providing their services. Contact form data is not sold.
These providers may process information outside the European Economic Area. Any international transfer must have applicable GDPR safeguards, such as an adequacy decision or standard contractual clauses, depending on the provider and service agreement. You can request information about destinations and applicable safeguards at agustin@agustinbosio.com.
Calendly and LinkedIn are external links. Opening them is subject to their operators’ terms and privacy policies. The contact form does not automatically send your details to those services.
6. Retention
Enquiries that do not lead to an engagement: up to 12 months from the last contact. If a professional relationship begins, necessary information will be processed during that relationship and for applicable periods relating to legal obligations or potential liabilities.
Marketing: until you withdraw consent or 24 months pass without interaction, whichever comes first. Only the minimum information needed to demonstrate consent and its withdrawal and respect an unsubscribe request is retained for applicable liability periods.
Technical logs are kept for the time needed for security and troubleshooting, according to the provider’s settings and terms. The controller manages deletion of enquiries and marketing lists; the form does not automatically delete emails.
7. Your rights and unsubscribing
You can request access, rectification, erasure, restriction, objection and portability where provided by the GDPR by writing to agustin@agustinbosio.com. Additional identity information will only be requested where necessary to handle your request.
You can withdraw marketing consent at any time using the same address or the unsubscribe method provided in communications. Withdrawal does not affect the lawfulness of earlier processing or prevent your professional enquiry from being handled.
Requests will generally be handled within one month, subject to extensions allowed by the GDPR. You can also complain to the Spanish Data Protection Agency (AEPD).
8. Language cookie
Choosing EN or ES stores a first-party cookie named lang to remember your preference for one year. You can delete it in your browser settings; the website will then detect the language from your browser preferences again.
The website does not include analytics tools or advertising cookies. External services you open through links may use their own cookies.
9. Security and updates
Requests to Google APIs use HTTPS. The form validates its fields, includes an antispam control and checks request origins. Credentials are managed on the server.
This policy will be updated when the information processed, purposes or services change. The update date appears at the top.