Privacy Policy

1. Data Controller

JETH Consulting, Calle de Serrano 41, 28001 Madrid, Spain. Email: info@jeth-consulting.com. Phone: +34 91 523 8147. CIF: B-XXXXXXXX.

2. Applicable Legislation

This Privacy Policy complies with: GDPR (EU Regulation 2016/679); LOPD-GDD (Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales); LSSI-CE (Ley 34/2002 de Servicios de la Sociedad de la Información y de Comercio Electrónico). Supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

3. Categories of Data Collected

Contact Data: Name, email, phone, company, role. Research Project Data: Competitive intelligence, customer interview recordings, survey data — strictly confidential under NDA. Payment Data: Stripe (PCI DSS L1). Analytics: Plausible (cookieless, EU-hosted).

4. Research Data Protection

When conducting customer research on behalf of clients: all interview recordings require participant consent (audio and GDPR Art. 6(1)(a)); participant data is pseudonymized in all reports; raw research data is deleted within 30 days of project completion; survey data is anonymized before analysis; we act as data processor (Art. 28 GDPR) for all research participant data.

5. Legal Bases and Purposes

Contract performance (Art. 6(1)(b)). Legal obligation (Art. 6(1)(c)). Legitimate interest (Art. 6(1)(f)). Consent (Art. 6(1)(a)).

6. Your Rights (GDPR + LOPD-GDD)

Access (Art. 15 GDPR / Art. 13 LOPD-GDD), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Portability (Art. 20), Objection (Art. 21), Withdraw consent (Art. 7(3)), Digital testament rights (Art. 3 LOPD-GDD). Contact: info@jeth-consulting.com. 30 days. AEPD complaint available at www.aepd.es.

7. Retention

Client data: engagement + 10 years. Research participant data: project + 30 days. Invoices: 6 years (Spanish tax law). Marketing consent: duration + 5 years.

8. Security

TLS 1.3, AES-256, MFA, EU servers, NDA for all analysts, 72h breach notification (Art. 33 GDPR).

9. International Transfers

Primary processing within EU/EEA. Stripe (USA): EU-US Data Privacy Framework. No other international transfers.

Last updated: March 2026.