Privacy Policy

Effective Date: March 2026 Last Updated: March 2026 Data Controller: Stefan Langwald, trading as PeakMaven, Barcelona, Spain

1. Introduction

PeakMaven (“we”, “us”, “our”) is a cybersecurity consultancy operated by Stefan Langwald, based in Barcelona, Spain. We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This Privacy Policy explains what data we collect when you visit our website at www.peakmaven.com, how we use it, and what rights you have.

2. Data Controller

The data controller responsible for your personal data is:

Stefan Langwald Trading as PeakMaven Barcelona, Spain Email: stefan@peakmaven.com

3. Data We Collect

3.1 Website Hosting (Bunny CDN)

Our website is delivered through Bunny.net, a content delivery network headquartered in Ljubljana, Slovenia. Bunny.net is a European company and processes data in accordance with the GDPR.

When you visit our website, Bunny.net may process the following technical data as part of standard HTTP delivery:

• IP address
• Browser type and version
• Requested URL and referring URL
• Date and time of the request

This data is processed for the purpose of delivering the website content to you and maintaining the security and availability of the service. Bunny.net does not use this data for tracking, profiling, or advertising.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — to deliver the website securely and reliably.

3.2 Appointment Scheduling (Google Calendar)

If you choose to book a consultation through our website, you will interact with Google Calendar Appointment Scheduling, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you book an appointment, Google processes the data you provide (such as your name and email address) in accordance with the Google Privacy Policy. Google acts as a data processor for the calendar scheduling functionality.

Google may transfer data to servers outside the European Economic Area. Google relies on Standard Contractual Clauses and additional safeguards for such transfers.

Legal basis: Consent (Art. 6(1)(a) GDPR) — you actively choose to book an appointment and provide your data.

3.3 Email Correspondence (Google Workspace)

If you contact us by email, your message is processed through Google Workspace (Gmail), provided by Google Ireland Limited.

Data processed may include:

• Your email address
• Your name (if provided)
• The content of your message
• Date and time of correspondence

Google acts as a data processor for email services. Google may transfer data to servers outside the European Economic Area, relying on Standard Contractual Clauses and additional safeguards.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — to respond to your enquiry. If the correspondence leads to a contractual relationship, processing is also based on Art. 6(1)(b) GDPR.

4. What We Do Not Collect

• No cookies: This website does not set any cookies.
• No analytics or tracking: We do not use any analytics tools (e.g., Google Analytics, Matomo, or similar).
• No third-party fonts: All fonts are self-hosted. No requests are made to Google Fonts or other external font services.
• No social media trackers: We do not embed social media widgets or tracking pixels.
• No advertising: We do not run ads or share data with advertising networks.

5. Data Retention

• Server access logs: Bunny.net may retain standard access logs in accordance with their own data retention policies. We do not independently collect or store access logs.
• Appointment data: Appointment bookings are retained in Google Calendar for the duration of the business relationship or until you request deletion.
• Email correspondence: Emails are retained for as long as necessary for the purpose of the communication or as required by applicable law.

6. Data Sharing

We do not sell, rent, or trade your personal data. Your data is only shared with the following processors, as described above:

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure (Art. 17) — request deletion of your data, where applicable.
• Right to restrict processing (Art. 18) — request that we limit how we use your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at stefan@peakmaven.com.

8. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Spain, the relevant authority is:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6 28001 Madrid, Spain Website: www.aepd.es

You may also contact the supervisory authority in your own EU member state.

9. International Data Transfers

All primary data processing occurs within the European Economic Area. Where data may be transferred outside the EEA (specifically through Google services), appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this page periodically.

11. Contact

For any questions about this Privacy Policy or your personal data, please contact:

Stefan Langwald Email: stefan@peakmaven.com