PRIVACY POLICY
​
Last updated 14 September 2025
Scope and purpose This Privacy Policy explains how Jael Ortega ("we" or "us") collects, uses, stores and shares personal data when you visit and interact with www.jaelortega.com ("the Website"). It describes your rights and how we meet our legal obligations under the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and other applicable data protection rules in the UK and the European Economic Area as they apply.
​
This policy applies to visitors, subscribers, clients and all users of the Website. It covers data collected directly from you, data collected automatically by the Website, and data we receive from third parties when acting as a controller.
​
What personal data we collect and why
We collect only the personal data we need to provide the Website, services and communications you request. Typical categories are:
​
-
Contact and identity data you give us when you contact us, book services, subscribe to newsletters or fill in forms. This may include name, email address, phone number and job title.
-
Payment and contract data needed to fulfil paid services. This may include limited billing details you choose to provide when purchasing services. We do not store full card details on our systems. Payment processing is handled by secure third party providers.
-
Communications data from messages sent to us or from emails and marketing interactions.
-
Usage and technical data collected automatically when you visit the Website. This includes IP address, browser and device information, pages visited, click events, referring site and timestamps. This data is used for analytics and to keep the Website working and secure.
-
Marketing engagement data such as opens, clicks and interaction history for subscribers who opt in to our email lists.
We collect data only for specific, lawful purposes and keep it no longer than necessary. Typical lawful bases for processing include consent, performance of a contract, compliance with a legal obligation and legitimate interests. When relying on legitimate interests we describe those interests and make sure they do not override individual rights.
Lawful basis for processing
We will only process personal data where we have a lawful basis to do so. The lawful bases we commonly rely on are:
​
-
Your consent when you sign up for marketing emails or agree to cookies that require consent.
-
Performance of a contract when you buy a service from us or request a booking.
-
Compliance with legal obligations such as tax or reporting duties.
-
Legitimate interests for activities like improving the Website, fraud prevention and ensuring security, provided your rights do not override those interests.
If you would like to know which lawful basis applies to a particular processing activity, email contact@jaelortega.com.
Cookies, trackers and similar technologies
We use cookies and similar technologies to make the Website work, to improve user experience and to provide analytics and marketing where you have given consent.
Essential cookies These are required to enable basic functions and are set when you use the Website. They do not require consent.
Non essential cookies We use non essential cookies only with your active consent. Examples include analytics cookies and marketing cookies used to measure campaign performance and personalise content.
Cookie examples (typical)
• _ga, _gid, _gat or equivalents for Google Analytics used to measure visitor behaviour and session counts. These cookies are set only after you accept analytics cookies.
• Mailchimp cookies to process newsletter subscriptions and track unsubscribes where you have opted in.
Please use our cookie preferences banner or your browser settings to withdraw consent at any time. Consent must be as easy to withdraw as it was to give.
Website analytics and third party services
We use third party services to provide analytics and email marketing. These providers act as processors under contract with us. Currently these include Google Analytics for anonymised traffic analysis and Mailchimp for email marketing and subscriber management.
Google Analytics and analytics providers We use analytics to understand how people use the Website and to improve it. Analytics providers may collect and store technical data and usage patterns. Where data is transferred outside the United Kingdom we rely on contractual safeguards, transfer mechanisms and other technical measures to protect your data.
​
Mailchimp and email processing Newsletter subscriptions and marketing lists are processed by Mailchimp. Mailchimp’s legal and privacy terms apply to the services they provide and they operate as a processor for the data you supply when subscribing. For specific details about Mailchimp’s practices please see the provider’s privacy documentation.
International data transfers
​
The Website operates from the United Kingdom. If we transfer personal data outside the United Kingdom we will do so lawfully. International transfers may happen when:
​
• we use a third party service provider based outside the United Kingdom or European Economic Area; or
• we process data on servers located outside the United Kingdom.
Where required we use an appropriate transfer mechanism such as an international data transfer agreement, the UK addendum to model clauses or other safeguards that meet UK GDPR requirements. We will always document any transfer risk assessment and only transfer where appropriate protections are in place.
How long we keep your data
​
We keep personal data only as long as necessary for the purpose it was collected and to meet legal, tax and accounting obligations. Typical retention periods are:
​
• Contact and marketing lists: until you unsubscribe or ask us to delete your data, unless a longer retention is required to meet legal obligations
• Financial records: for up to 7 years where required for tax or accounting
• Website usage logs: typically up to 24 months for analytics, unless a longer time is required for security incident investigation
If you need specific retention periods for certain data types, please contact contact@jaelortega.com.
​
Sharing your data and third party processors
We do not sell or trade personal data to third parties.
We may share personal data with:
• trusted service providers performing services for us such as email marketing, analytics, payment processors and hosting providers
• legal and regulatory authorities if required to comply with legal obligations or to protect the rights, property or safety of the Website and users
All third party processors are required to keep data secure and only process data in accordance with our instructions.
Security
​
We take reasonable technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
​
These measures include secure hosting, encrypted data transfer, regular software updates and restricted access to systems holding personal data.
While we strive to protect personal data, no internet transmission can be guaranteed to be 100 per cent secure. If you believe there has been a breach involving your data please contact contact@jaelortega.com immediately.
Marketing and electronic communications
​
We will only send marketing communications if you have given consent or where we have a legitimate interest and it is allowed by law. All marketing messages will include an easy way to unsubscribe. You can also unsubscribe by emailing contact@jaelortega.com.
​
For direct marketing by email the Privacy and Electronic Communications Regulations apply. If you are resident in the UK and have not opted in to marketing communications you will not receive marketing emails unless another lawful basis applies.
​
Your rights
​
Under the UK GDPR you have the following rights, subject to conditions and exemptions:
​
• the right to be informed about how your data is used • the right of access to your personal data • the right to rectification of inaccurate data • the right to erasure in certain circumstances • the right to restrict processing • the right to data portability where applicable • the right to object to processing based on legitimate interests or for direct marketing • rights related to automated decision making including profiling
If you wish to exercise any of these rights, contact contact@jaelortega.com. We will respond in line with statutory timescales. You can also make a complaint to the Information Commissioner’s Office.
Children
​
The Website is not intended for children under 16 unless explicit arrangements are in place and parental consent is provided. We do not knowingly collect or process personal data from children under 16.
​
Automated decision making and profiling
​
We do not carry out automated decision making or profiling that has a legal or similarly significant effect on you without clear notice and an additional lawful basis.
​
Changes to this policy
We may update this policy from time to time. Any material changes will be posted on the Website with an updated date. Continued use of the Website after changes indicates acceptance of the revised policy.
Complaints
If you are unhappy with how we have handled your personal data please contact contact@jaelortega.com in the first instance. You also have the right to complain to the Information Commissioner’s Office.
​
Administration notes for our team
​
This policy assumes the following third party services are in use: Google Analytics and Mailchimp. If you change providers or add new services, update the cookie table and the third party processor list and ensure contractual records and transfer risk assessments are in place.
Contact
​
Controller name: Jael Ortega Email: contact@jaelortega.com
​
This document is a general purpose privacy policy template for the Website. It does not constitute legal advice. For tailored legal advice please consult a qualified data protection professional or solicitor.
​
​
