This English version is provided for convenience. If there is any difference, the Spanish version (Política de privacidad) prevails.

At romillyanne.com we respect your privacy. This policy explains what personal data we collect, why we use it and what rights you have, under the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (LOPDGDD).

1. Who is responsible for your data

  • Data controller: Romilly Anne
  • Tax ID (NIF/NIE): available on request at info.millyanne@gmail.com
  • Address: Monforte de Lemos, Lugo, Spain
  • Contact email: info.millyanne@gmail.com

2. What data we use, why, and on what legal basis

Blog comments. Name, email, website (optional), your comment and IP address. Used to publish and moderate your comment and prevent spam. Legal basis: your consent when you submit the comment. Kept: while the comment is published, or until you ask us to delete it.

Newsletter and free downloads. Name (optional), email and preferred language. Used to send you the freebie you asked for and our newsletter with new posts, recipes and shop news. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in every email. Kept: until you unsubscribe.

Shop purchases. Name, email, billing address, country, order history and the details needed for payment (card details are handled directly by the payment provider; we never see or store them). Used to process your order, send your download links, issue invoices, handle any problems and meet our tax obligations. Legal basis: performing our contract with you and complying with legal obligations. Kept: for as long as needed for the order and then for the legally required periods (generally 6 years for accounting and tax records).

Customer account and membership (if you create one). Name, email, encrypted password and subscription details. Legal basis: performing our contract with you. Kept: while the account is active and then for the legally required periods.

Contacting us by email. Whatever you send us. Used to reply. Legal basis: your consent or, if it’s about an order, performing our contract. Kept: as long as needed to deal with your message.

Analytics. Only if you accept statistics cookies, we use Google Analytics to understand, in aggregate, how the site is used (pages visited, device type, approximate country). Legal basis: your consent. See our Cookie Policy.

Security. We log IP addresses and technical access data to protect the site from attacks and unauthorized access. Legal basis: our legitimate interest in keeping the website secure.

We don’t make automated decisions or create profiles that have legal effects on you.

3. Who we share data with

We never sell your data. We only share it with service providers who act as data processors on our behalf, with the safeguards the GDPR requires:

  • GoDaddy: website hosting.
  • MailerLite: newsletter and free download emails.
  • Stripe and PayPal: payment processing.
  • Google (Analytics, YouTube): statistics, only with your consent, and embedded videos.
  • Defiant (Wordfence): website security.
  • Automattic (Jetpack Boost): speed and image optimization.
  • Pinterest: buttons and embedded content, only with your consent.
  • our tax advisor (gestoría): accounting and tax.

We may also share data with public authorities where the law requires it (for example, the Spanish Tax Agency).

4. International transfers

Some of these providers are based in the United States or may access data from there. Where that happens, transfers are covered by the EU-US Data Privacy Framework (for certified companies) or by the European Commission’s standard contractual clauses.

5. Your rights

You can ask at any time to access, correct, delete, restrict or port your data, object to its use, or withdraw your consent (without affecting anything done before). Email us at info.millyanne@gmail.com and tell us which right you want to exercise. We may ask you to confirm your identity. We’ll reply within one month.

If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the data protection authority where you live.

6. Children

This website is aimed at adults. We don’t knowingly collect data from children under 14. If you’re a parent or guardian and think a child has given us their data, email us and we’ll delete it.

7. Security

We use appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), backups, a firewall and restricted access to the admin area.

8. Changes to this policy

We may update this policy to reflect changes in the law or in our services. The current version will always be on this page.

Last updated: October 19, 2026