Privacy policy

1. Data controller

2. What data we process

If you write to us through the website contact form, we process the data you submit: name, email address, company (if provided) and message.

If you write to us by email, we process your identifying, professional and contact details, and the information included in your message and in the subsequent relationship.

If you accept analytics cookies, we process browsing data and online identifiers to produce aggregated statistics on the use of the site. More information in the cookie policy.

Business prospecting. We may process the professional contact details of executives at companies that fit our client profile: name, job title, company, business email address and public professional information.

We obtain these data from publicly available sources, such as company websites and professional publications, and from third-party professional directories. Until 19 October 2026, also from a US-based professional directory provider.

3. Purposes and legal basis

• To handle your enquiries and requests for information, including those submitted via the contact form. Legal basis: taking steps at your request prior to entering into a contract, or our legitimate interest in responding to professional enquiries.
• To assess, prepare and manage a professional or contractual relationship. Legal basis: performance of the contract or taking steps prior to entering into it.
• To comply with legal obligations and address possible liabilities. Legal basis: compliance with legal obligations and our legitimate interest in defending ourselves against claims.
• To protect the security of the site and prevent abuse. Legal basis: our legitimate interest in protecting our systems.
• To measure site usage in aggregated form. Legal basis: your consent to analytics cookies, which you may withdraw at any time via «Cookie settings».
• Business prospecting: contacting executives at companies to present our advisory services. Legal basis: our legitimate interest (art. 6.1.f GDPR) in presenting our professional services to businesses, limited to business contact data and balanced against your rights. We only send commercial emails where the applicable rules allow it.

The data requested in the contact form are necessary to reply to you; if you do not provide them, we will not be able to handle your enquiry.

4. Recipients and providers

We may disclose your data to the following categories of recipients:

• Technology service providers (email, web hosting and contact-form processing), acting as processors.
• A web analytics provider, only where you have accepted analytics cookies.

Data may also be disclosed to authorities where there is a legal obligation to do so.

Some of these providers are located in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or, where it does not apply, on the European Commission's Standard Contractual Clauses, about which you may request information or a copy at gdpr@yearonepartners.com.

5. Retention periods

Data will be retained for as long as necessary to handle the request and manage the professional relationship. Thereafter they may be retained in a blocked form for the applicable legal periods or for as long as liabilities may arise.

Prospecting data are deleted 6 months after the last contact if there is no reply, or without delay upon objection, except for the minimum needed to keep you on our suppression list.

6. Your rights

You may request access, rectification, erasure, restriction of processing and portability of your data where applicable, and withdraw any consent you have given at any time, without affecting the lawfulness of processing before its withdrawal. To exercise these rights, write to gdpr@yearonepartners.com stating the right you are exercising and the information needed to verify your identity.

Right to object. You may object at any time to processing based on our legitimate interest and, in particular, to business prospecting (direct marketing). Simply reply to any of our emails asking us to stop, or write to gdpr@yearonepartners.com. We will stop processing your data for that purpose without delay.

You may also lodge a complaint with the Spanish Data Protection Agency if you consider that the processing does not comply with the applicable legislation.