Privacy policy

Last updated 2026-08-22

Who is responsible

The controller of any personal data processed through this site is:

There is no data protection officer, because a one-person publication carrying out no large-scale or systematic monitoring is not required to appoint one. Requests go to the address above and are answered by the publisher personally.

The short version

You can read every article on this site without giving any personal data, without an account, and without accepting any non-essential cookie. If you decline the consent dialogue, nothing about your visit is measured and nothing follows you elsewhere.

If you accept, an analytics tool records aggregate usage and an advertising network selects advertisements. If you write to the publisher, the message and your email address are processed so the message can be answered.

That is the whole of it. There is no newsletter, no account system, no comment section, no social login, and no data broker anywhere in this arrangement.

What is processed, and why

Server logs

Hosting is provided by a content delivery network. Its edge servers necessarily process the IP address of every request, the page requested, the time, the response status, the user agent and the referring page, for the technical purpose of delivering the file and for security. This is unavoidable in the operation of any website.

• Purpose: delivering the site and defending it against abuse.
• Legal basis: legitimate interest under Article 6(1)(f) GDPR, namely operating a functioning and secure website.
• Retention: by the hosting provider, according to its own retention schedule. The publisher does not keep an independent copy and does not build reader profiles from these logs.

Analytics

The site is prepared to use Google Analytics 4. It is loaded only after you have given consent, and it is not loaded at all until a measurement identifier is configured. While no identifier is configured, no analytics script is requested and no analytics cookie is set.

• What it records: pages viewed, approximate location derived from a truncated IP address, device category, referring source, and events such as scrolling to the foot of an article.
• Purpose: knowing which articles are read and which are not, so the next ones are better.
• Legal basis: your consent, Article 6(1)(a) GDPR.
• Sharing: with Google, acting as a processor. Transfers outside the European Economic Area are covered by the mechanisms Google publishes for its analytics products.
• Withdrawing consent: the "Cookie settings" control at the foot of every page.

Advertising

The site is prepared to serve advertising through Google AdSense. Google and its advertising partners act as independent controllers of the data they process for advertisement selection and measurement.

Inside the European Economic Area, the United Kingdom and Switzerland, no advertising cookie or device identifier is read or written until consent is collected through a consent management platform certified against the IAB Transparency and Consent Framework. Before that dialogue exists and before a publisher account is live, no advertising script is loaded at all.

• Purpose: funding the site.
• Legal basis: your consent, Article 6(1)(a) GDPR.
• What Google does with it: described in Google's own privacy documentation and in the vendor list shown inside the consent dialogue, which is the authoritative list because it changes.

The contact form

The form on the contact page posts to a third-party form relay, which forwards the message to the publisher's mailbox and does not retain it beyond delivery. While no relay key is configured the form is not displayed at all, and the page shows a plain email address instead — a form that silently discards messages is worse than no form.

• What is processed: your name, your email address, the subject you chose and the message you wrote.
• Purpose: answering you.
• Legal basis: legitimate interest under Article 6(1)(f) GDPR — responding to somebody who has written to us — and, for the content you volunteer, your evident intention that it be read.
• Retention: correspondence is kept while the matter is open and for up to twenty-four months afterwards, so that a correction to an article can be traced back to the person who reported it. Then it is deleted.

What is not processed

• No account, no password, no profile.
• No newsletter list. There is no sign-up form on this site.
• No social platform pixels. There is no embedded tracking from any social network.
• No comment system.
• No fingerprinting, no session recording, no heatmaps.
• No special category data, and no data relating to children. The site is written for finance and tax professionals and is not directed at anyone under 18.
• Nothing is sold, rented or shared for anyone else's marketing.

Cookies

Set out separately, in detail, in the cookie policy, including how to withdraw consent.

Recipients

• The hosting and content delivery provider, as a processor.
• Google, for analytics as a processor and for advertising as an independent controller, once each is switched on and once you have consented.
• The form relay provider, as a processor, for messages you send.

No one else. In particular, no advertising data broker receives anything as a result of a decision made by this publisher.

International transfers

Some of the providers above process data outside the European Economic Area. Where they do, transfers rely on the European Commission's standard contractual clauses or on an adequacy decision covering the receiving country. Copies of the relevant terms are published by each provider.

Your rights

Under the GDPR you have the right to request access to your personal data, rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time, which does not affect the lawfulness of what happened before.

Write to editor@clearancemodel.com. Requests are answered within one month. There is no charge.

In practice, the data this site holds about an individual reader is almost always nothing at all. If you have never written to the publisher and never accepted the consent dialogue, there is no record connecting you to this site beyond the hosting provider's technical logs.

If you believe your data has been mishandled, you may complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the supervisory authority of the Member State in which you live.

Automated decision-making

None. Nothing on this site makes an automated decision producing legal effects for a reader.

Changes

Material changes to this policy are reflected in the revision date at the top of the page. A change that widens what is processed will not be applied retroactively to data already collected under a narrower notice.