Legal
Privacy policy
Last updated: 2026-08-14
Who processes your data
The data controller is Elena Tikhonova, self-employed (autónomo) under Spanish law, NIE Z1155995C, Barcelona, Spain.
For any question about data processing: elena.tikhonova@foodtech-consulting.kz.
As the controller is established in Spain, processing is governed by the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Spanish LSSI-CE.
What we collect
We collect only what you provide yourself, and only for the stated purpose.
| What you do | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Subscribe to the newsletter | Email, language, consent date and IP | Sending new articles | Consent (Art. 6.1.a) | Until you unsubscribe |
| Use the contact form | Name, email, company, message | Replying to your enquiry | Consent and pre-contractual steps (Art. 6.1.a, 6.1.b) | 12 months |
| Book a meeting | Name, email, company, timezone, topic | Arranging the meeting | Pre-contractual steps (Art. 6.1.b) | 3 years |
| Submit a speaking request | Name, email, organisation, event details | Reviewing the request | Consent (Art. 6.1.a) | 12 months |
| Simply read the site | Anonymous visit statistics | Understanding which content is useful | Legitimate interest (Art. 6.1.f) | 24 months, aggregated |
We do not collect special category data (health, beliefs, biometrics) and we do not use automated decision-making or profiling.
Cookies and analytics
Without your consent, this site uses no advertising cookies, no third-party trackers and no cross-site tracking.
Visit statistics come from Vercel Analytics, a cookieless tool: it sets no cookies, stores no identifiable IP addresses, and cannot track an individual across sites.
With your analytics consent, we also use Microsoft Clarity — it builds click maps and session recordings so we can see where the interface confuses. Clarity sets its own cookies and loads only after consent to the “Analytics” category: it is not loaded if you decline, and collection stops if you withdraw consent.
On the same terms we use Google Analytics 4 — audience and on-site journey statistics. Both counters load only after consent to the “Analytics” category and only on the production site. GA4's advertising features — Google Signals (cross-device and account-based demographics) and ad personalisation — are enabled ONLY with separate consent to the “Marketing” category; with analytics-only consent they stay off.
Yandex.Metrica (including Webvisor — on-page session recording) is loaded ONLY for visitors from Russia and CIS countries, and only with their analytics consent; its data is processed in Russia. For visitors from other countries, including the EU, Metrica is not loaded and their data is not sent to Yandex.
With separate consent to the “Marketing” category we use advertising pixels — Meta Pixel and Microsoft UET (Bing) — for retargeting and ad measurement. Without marketing consent they do not load.
Two cookies are strictly necessary: NEXT_LOCALE remembers your chosen language, and et_consent stores your cookie decision so you are not asked again.
One cookie is optional — et_attr. It remembers the campaign label from the link you arrived through and the host of the referring site, so we can tell which publications lead to enquiries. It is set only after your consent and is deleted the moment you withdraw it. That cookie is the reason this site has a consent banner.
More detail in the cookie policy.
Who receives your data
We do not sell data and we do not share it with third parties for their own purposes. Data is processed only by service providers that keep the site running:
| Provider | Role | Processing location |
|---|---|---|
| Vercel Inc. | Website hosting | EU / US (standard contractual clauses) |
| Supabase Inc. | Database and storage | EU (Frankfurt) |
| Resend | Email delivery | EU / US (standard contractual clauses) |
| Google LLC | Calendar for meeting bookings | EU / US (standard contractual clauses) |
| Vercel Analytics | Cookieless visit statistics | EU / US (standard contractual clauses) |
| Microsoft Clarity (Microsoft Corporation) | Click maps and session recordings — only with your consent | EU / US (standard contractual clauses) |
| Google LLC (Google Analytics 4) | Audience and on-site journey statistics — only with your consent | EU / US (standard contractual clauses) |
| Yandex LLC (Yandex.Metrica, Webvisor) | Statistics and session recordings — only for RU/CIS visitors and with their consent | Russia |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Retargeting and ad measurement — only with marketing consent | EU / US (standard contractual clauses) |
| Microsoft Corporation (Bing Ads, UET) | Retargeting and ad measurement — only with marketing consent | EU / US (standard contractual clauses) |
| Functional Software, Inc. (Sentry) | Technical error reports. Server-side always (without your data); from your browser — only with analytics consent | EU / US (standard contractual clauses) |
A data processing agreement (DPA) is in place with each provider. Transfers outside the EEA, where they occur, are covered by the European Commission's standard contractual clauses.
Your rights
Under the GDPR you have the right to:
- access — obtain a copy of your data;
- rectification — correct inaccurate data;
- erasure — request deletion ("right to be forgotten");
- restriction of processing;
- portability — receive your data in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal.
To exercise any right, write to elena.tikhonova@foodtech-consulting.kz. We respond within 30 days.
You can unsubscribe from the newsletter in one click via the link in any email — no login required.
If you believe your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or with the supervisory authority in your country.
How we protect data
- HTTPS-only connections with modern encryption.
- Database access is restricted by row-level policies enforced by the database itself, not only by application logic.
- Administrative access uses passwordless one-time links, limited to an explicit list of addresses.
- Unsubscribed addresses are kept only as a hash — enough not to email you again, without storing the address.
- Database backups are taken daily and retained for 7 days.
Children
This site addresses entrepreneurs and is not intended for anyone under 16. We do not knowingly collect children's data.
Changes to this policy
For material changes we will update the date at the top of this page. If a change affects the basis for processing, subscribers will be notified by email.