Privacy policy
Last updated: 25 September 2026
In short: I only collect what I need to talk to you, work with you and send invoices. I don't sell your data, I don't use advertising trackers, and you can ask me to delete your details at any time by emailing serena@newadventuresinaifi.com.
Who is responsible for your data
The controller is Serena Manzoli, trading as New Adventures in AI-Fi, , Valencia, Spain. Contact: serena@newadventuresinaifi.com.
I have not appointed a Data Protection Officer, as the law doesn't require one for a business of this size and type. Write to the email above for anything related to your data.
What I collect and why
When you email me
Your name, email address and whatever you choose to write. I use it to reply and, if we work together, to prepare a proposal.
Legal basis: taking steps at your request before a possible contract, and my legitimate interest in answering enquiries. Kept for: up to 2 years after our last contact, unless we start working together.
When you join the pilot waitlist
The details you enter in the form, such as your name and email. The form is provided by Airtable, which stores the answers for me. I use them to contact you about a possible pilot project.
Legal basis: taking steps at your request before a possible contract. Kept for: up to 2 years, or until you ask me to remove you.
When you book a call
Booking happens on Calendly's website. Calendly collects your name, email, chosen time and any answers you give, and shares them with me so we can meet.
Legal basis: taking steps at your request before a possible contract. Kept for: up to 2 years after the call, unless we start working together.
When you request a website compliance screening
If you ask me to check websites, I collect your name, firm, email, role, the website addresses you send, and your logo if you provide one. The scan reads the public pages of those websites, including their privacy and cookie notices, and records which services they contact. It doesn't log in, and it doesn't submit forms unless you have asked for that and the site owner has agreed.
By submitting a website you confirm that you are authorised to have it checked.
Legal basis: taking steps at your request, and my legitimate interest in providing and improving the service. Kept for: reports and scan data for 12 months; contact details as for enquiries above.
Business contacts I reach out to
I sometimes contact professionals, such as privacy consultancies, who may be interested in my services. I use business contact details that are publicly available, for example on company websites, LinkedIn or official company registers: name, role, firm and business email.
Legal basis: my legitimate interest in offering relevant services to businesses. Every message tells you how to opt out, and if you do, I won't contact you again. Kept for: up to 2 years after the last contact, or until you object.
Clients
Names, contact details, project information and billing details of the people I work with.
Legal basis: performing our contract, and complying with tax and accounting law. Kept for: as long as the project lasts, then for the periods required by tax and commercial law (generally up to 6 years).
When you visit this website
Like any website, the server hosting it records technical information such as your IP address, browser type and the pages requested, to deliver the site and keep it secure. This website does not use analytics or advertising trackers. See the cookie policy for details.
Legal basis: my legitimate interest in running a secure website. Kept for: as set by the hosting provider, usually a few weeks.
Who else handles your data
I use a small number of service providers who process data on my behalf, under contracts that protect it:
| Provider | What for | Where |
|---|---|---|
| Render | Hosting this website | United States |
| Microsoft Outlook | United States | |
| Google (Google Analytics) | Website statistics, only with your consent | Ireland and United States |
| Airtable | Pilot waitlist form | United States |
| Calendly | Booking calls | United States |
| Airtable | Screening request form | United States |
| GitHub (Microsoft) | Running website scans and storing reports | United States |
| Anthropic | AI review of public privacy notices during scans | United States |
I don't sell your data or share it with anyone for their own marketing. I may disclose it if the law requires, for example to tax authorities.
Transfers outside Europe
Some providers above are based in the United States. Where they are certified under the EU-US Data Privacy Framework (and its UK Extension), transfers rely on that; otherwise they rely on the European Commission's standard contractual clauses (with the UK addendum for UK data). You can ask me for more information about the safeguards for any provider.
Your rights
You can ask me to:
- give you a copy of the data I hold about you
- correct it if it's wrong
- delete it
- restrict how I use it
- stop using it, where I rely on legitimate interest, including for any outreach
- send it to you or another organisation in a portable format
- withdraw any consent you have given, at any time
Email serena@newadventuresinaifi.com. I'll reply within one month.
If you're unhappy with how I handle your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos. If you're in the UK, you can also contact the Information Commissioner's Office.
Other things you should know
You don't have to give me any data, but without contact details I can't reply to you or work with you. I don't make decisions about you based solely on automated processing.
If I change this policy, I'll update the date at the top.