Last updated: 5 October 2026.
This policy explains how SpicyCEO handles personal data. SpicyCEO is an independent online publication written and edited by Natalia Ferrari (a pen name), based in Spain. For anything about your data, email [email protected].
Because we’re based in Spain, the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (LOPDGDD) apply. We follow the same standards for every reader, wherever you live.
The short version
- You can read everything on SpicyCEO without giving us any personal data.
- We don’t use advertising or tracking cookies, and we don’t run analytics that follow you around.
- We only get your email address if you write to us or, once it launches, sign up for our newsletter.
- We never sell your data. Ever.
What we collect
- Emails you send us: your email address, your message and anything you choose to include, so we can reply.
- Newsletter sign-ups: our newsletter, Sunday Spice, isn’t live yet. When it launches, we’ll store your email address with an email service provider so we can send you the newsletter you asked for, and we’ll name that provider here before we collect a single address.
- Technical data: like every website, our servers and our security and delivery network (Cloudflare) process your IP address and basic browser details when you visit, to deliver the page and protect the site from attacks and abuse. We don’t use this to identify you.
We don’t ask for, and don’t want, sensitive information. Please don’t send us your legal name, ID documents or account logins.
Why we use it (legal basis)
- Replying to your emails: our legitimate interest in answering you (GDPR Article 6(1)(f)).
- The newsletter: your consent (Article 6(1)(a)), which you can withdraw any time with the unsubscribe link in every email.
- Security and delivery: our legitimate interest in keeping the site safe and working (Article 6(1)(f)).
Who we share it with
Only with service providers that process data on our behalf, under contracts that require them to protect it: our web hosting provider, Cloudflare (security and content delivery) and, once it launches, our email service provider. Some of them may process data outside the European Economic Area. Where they do, they rely on safeguards recognised under the GDPR, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
We don’t share your data with advertisers, data brokers or anyone else, and we never sell it.
How long we keep it
- Emails: up to two years after our last exchange, then deleted, unless you ask us to delete them sooner.
- Newsletter data: until you unsubscribe.
- Technical and security logs: only as long as our providers need them for security, usually a short period.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you,
- correct it,
- delete it,
- restrict or object to how we use it,
- send it to you or another service in a portable format,
- and, where we rely on consent, withdraw it at any time.
Email [email protected] and we’ll answer within one month. If you’re not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in the country where you live.
Age
SpicyCEO is for adults. We don’t knowingly collect data from anyone under 18. If you think someone under 18 has contacted us, let us know and we’ll delete it.
Cookies
See our cookie policy.
Changes
If we change how we use your data, we’ll update this page and the date at the top. If the change is significant (for example, adding a new tool when the newsletter launches), we’ll make it clear on the site first.