Privacy Policy

1. Data controller

The controller of personal data collected through this website is Cecile Umaña, a natural person, acting in a personal professional capacity. Contact for data-protection matters, including the exercise of your rights: privacy@cecileumana.com.

A postal address and tax identification number are not published at this stage, as no commercial service-provider structure has been established for this website. They will be added if and when professional services are offered commercially through the site.

Tangram HR Solutions is mentioned on this site only in connection with professional background and credentials. It is not the owner, operator or data controller of this website, and no obligation of its own arises from the site's content.

2. What data is collected

• Contact-form data: first name, last name, email, current role, company (optional), country, reason for enquiry, context you choose to share and preferred timing.
• Technical data strictly necessary to serve the site (e.g. IP address processed transiently by the hosting provider, browser and device type).
• Cookie-consent preferences you set on this site.

3. Why it is used and on what legal basis

• To respond to your enquiry and assess a possible engagement — legal basis: your consent (Art. 6(1)(a)) and/or steps prior to entering a contract (Art. 6(1)(b)).
• To operate, secure and maintain the website — legal basis: legitimate interest (Art. 6(1)(f)).
• To comply with accounting, tax and other legal obligations where an engagement follows — legal basis: legal obligation (Art. 6(1)(c)).
• Non-essential cookies or analytics, if ever enabled — legal basis: your consent, which you may withdraw at any time.

4. Confidentiality

Executive advisory work is confidential by nature. Enquiries and any information shared in a first conversation are treated as confidential and are not disclosed to third parties, except where disclosure is required by law.

5. Recipients and processors

Personal data may be processed by service providers acting on documented instructions as processors — website hosting, email and, where relevant, scheduling tools. Processors are bound by data-processing agreements under Art. 28 GDPR. Personal data is never sold.

6. International transfers

Where a provider processes data outside the European Economic Area, transfers rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with appropriate supplementary measures.

7. Retention

• Enquiries that do not lead to an engagement: retained for up to 12 months, then deleted.
• Client records: retained for the duration of the engagement and for the periods required by commercial, tax and accounting law.
• Cookie-consent records: up to 12 months.

8. Your rights

You may request access, rectification, erasure, restriction, portability, object to processing and withdraw consent at any time by writing to privacy@cecileumana.com. Requests are answered within one month. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

9. Security

Appropriate technical and organisational measures are in place to protect personal data against unauthorised access, loss or disclosure, including encryption in transit and access controls.

10. Children

This website and these services are directed at professional adults. Personal data of children is not knowingly collected.

11. Changes

This policy may be updated to reflect changes in the services or in legal requirements. The date of the current version is shown above.